Posted on

The Gabbard–Butler Matter as Counterintelligence Disaster, a Controller in the Blind Spot

Tulsi Gabbard, ODNI, DNI, espionage, counterespionage, intelligence, counterintelligence, CIA, NSA, C. Constantin Poindexter

There is nothing pretty at all about this Tulsi Gabbard insanity. The documented relationship between former Director of National Intelligence Tulsi Gabbard and Chris Butler, founder of the Science of Identity Foundation (SIF), constitutes a counterintelligence failure of f* first order. Drawing on the Washington Post investigation by Jon Swaine (2026) and the broader scholarly and governmental literature on high-control groups, I assess that the preponderance of indicators points to a ranking member of the Intelligence Community who was, at minimum, subject to sustained, concealed, and operationally structured external direction by a fringe cult of personality. I situate the issue within the established framework of undue influence and the agent-of-influence problem, and I argue, with some comparison to six historical cases (the Unification Church, the Church of Scientology, Aum Shinrikyo, the Rajneeshpuram commune, the Peoples Temple, and NXIVM), that the United States possesses ample precedent for treating charismatic-leader organizations as national security threats rather than as private spiritual matters. The distinguishing and aggravating feature of the present case is the controller’s tradecraft of concealment, which mirrors the operational security of a hostile clandestine service and may well have defeated, for more than a decade, the vetting mechanisms that should have DQ’d this crazy lady.

My thesis stated plainly

A counterintelligence operator does not require proof of espionage to break the glass. The discipline is preventive and structural. It concerns itself with vulnerabilities, channels, and concealment long before it concerns itself with the transfer of any specific secret. By that standard, the facts now in the public record describe a disaster. A person who rose to the statutory apex of the United States Intelligence Community, with derivative access to the most sensitive compartmented information the government produces, appears to have operated for much of her political career under the directive influence of an unaccountable external oddball, through a channel deliberately engineered to evade discovery, while publicly denying the relationship that the now publicly aired documentary record describes (Swaine 2026). That sentence, if its components hold, is a textbook description of the precondition for compromise. I am not stating that Tulsi Gabbard was a foreign agent. I don’t subscribe to bullshit conspiracy theories and I am not C.I.-spooky enough to see an enemy behind every corner, however, the architecture of her influence relationship is indistinguishable, in its mechanics and its concealment, from the architecture a hostile service would build. This architecture was permitted to reach the top of the I.C. either undetected or, detected and ignored. I am not going to address Gabbard’s bullshit support of dictators and despots, as that is outside of my purpose here, however, my thoughts about what Swaine has reported may leave you wondering about her positions on Syria, Russia and other U.S. adversaries.

The evidentiary record

The factual spine of my assessment is the year-long investigation by Washington Post reporter Jon Swaine, who obtained more than twenty-five thousand pages of emails, memos, and related messages, including hundreds of confidential memos spanning the years 2011 to 2017, most of them coinciding with Gabbard’s first two congressional terms (Swaine 2026). The material was furnished by Rebecca Saltzburg, a former SIF member who had worked on digital strategy for several of Gabbard’s congressional campaigns. According to the reporting, the memos issued from email addresses on the Nine Isles domain, identified as reserved for the office of Chris Butler, and contained directives on legislation Gabbard should introduce, policy positions she should adopt, and the manner in which she should conduct herself on television (Swaine 2026).

Two features of the record deserve emphasis at the outset. The parallelism between directive and action. The Post documented instances in which a memo preceded a corresponding public act within days, a 2014 memo pressing for legislation to penalize countries whose citizens had joined the Islamic State was followed by a Gabbard statement the next day and a bill within the week (Swaine 2026). Second, attribution methodology. Because the memos were authored anonymously, Swaine resorted to stylometric analysis (the statistical study of authorial fingerprints in word choice and usage) comparing the memos against Butler’s archive of recorded lectures as well as the writing of two other candidate authors. Nonstandard usages such as “duplistic” and “judgmentalism” recurred across the memos and Butler’s lectures, and a first-person reference to a Hawaiian adolescence fit Butler rather than his deputy Sunil Khemaney, who had claimed authorship (Swaine 2026). Stylometry as a forensic instrument is not novel. It is the same family of methods that Mosteller and Wallace (1964) used to resolve the disputed authorship of The Federalist. Its probative weight here is considerable precisely because the controller took pains to remain anonymous.

For the integrity of the assessment, there are some limits to put on the record. The documents cover 2011 to 2017 and therefore cannot establish whether the directive relationship continued into Gabbard’s later terms or into her tenure as Director of National Intelligence (Swaine 2026). The provenance is a single defector with a possible motive, and Gabbard’s office has characterized the reporting as flowing from a failed extortion attempt and as an instance of anti-Hindu bigotry (Swaine 2026). I treat these caveats seriously a bit later. They constrain the claim. They do not dissolve it.

The analytical framework: influence, control, and the agent of influence

Counterintelligence distinguishes among three phenomena that the non-CI folk tend to collapse: ordinary influence, coercive control, and espionage. Political actors are influenced by mentors, donors, and constituencies as a matter of course, which is unremarkable. Espionage, the witting transfer of protected information to an adversary, is a discrete crime for which the public record here offers no evidence. The category that matters for this case is the middle one, and it has a specific name in the literature of hostile intelligence, “the agent of influence”, an individual who advances another principal’s objectives within a target government, whether wittingly or not, often through a relationship the target population does not perceive (Andrew and Mitrokhin 1999).

The agent-of-influence problem is dangerous in proportion to two variables: the access of the individual and the concealment of the channel. The personnel security system encodes precisely this logic. The National Security Adjudicative Guidelines promulgated under Security Executive Agent Directive 4 treat foreign and external influence (Guideline B), personal conduct involving concealment (Guideline E), and susceptibility to manipulation, coercion, or duress as core disqualifying conditions for access to classified information (ODNI 2017). A relationship that an applicant conceals, and especially one she has publicly denied, is doubly disqualifying: it establishes both the undue-influence vulnerability and the demonstrated willingness to deceive about it.

The clinical literature on high-control groups supplies the mechanism by which such a relationship can produce a level of direction far exceeding ordinary mentorship. Lifton’s (1961) study of thought reform identified milieu control, the demand for purity, the cult of confession, and the doctrine of “sacred science” as instruments of totalist control; Singer (1995) catalogued the systematic conditions under which adult autonomy is overridden within such groups; and Hassan (1988) formalized the analysis as the BITE model, the coordinated control of Behavior, Information, Thought, and Emotion. The salient point for counterintelligence is that a person conditioned within such a system from childhood does not present the profile the vetting system is designed to detect. There is no recruitment event, no foreign handler meeting, no financial inducement to find. The control predates adult life. This is the deepest reason the present case is not merely serious but novel. I’ll return to it a bit later.

The Unification Church: cult as influence vehicle with an intelligence nexus

The closest precedent in American constitutional history for treating a charismatic-leader organization as a counterintelligence matter is the investigation of the Unification Church conducted by the Subcommittee on International Organizations of the House Committee on International Relations, chaired by Representative Donald Fraser. The Fraser Committee found that the Moon organization and its many religious and secular fronts constituted “essentially one international organization” over which Sun Myung Moon exercised substantial control in pursuit of political objectives (U.S. House 1978). It further found active cooperation between the Korean Central Intelligence Agency and Moon-related entities, that some church members worked as volunteers in congressional offices, and that the apparatus operated as an instrument of a foreign government’s influence campaign on American politics (U.S. House 1978; Boettcher 1980).

The structural analogy to SIF is exact at the level that matters: a single charismatic principal exercising centralized control over a transnational network of nominally independent entities, deploying that network toward political ends, and placing adherents inside the offices of elected officials. The Japanese variant of the same organization later achieved the same penetration of the Liberal Democratic Party, again by placing followers as legislative secretaries and by delivering bloc votes (Nippon.com 2026). The Fraser precedent establishes the principle I am invoking: when a cult of personality reaches into the staffing and policy of a government, the United States Congress has already determined, on the record, that the appropriate frame is counterintelligence, not comparative religion. The defensive rhetoric is also precedent-setting. Moon’s deputy Bo Hi Pak met the subcommittee’s questions by denouncing the chairman as “an instrument of the Devil” rather than by answering them (U.S. House 1978). The contemporary invocation of bigotry to foreclose inquiry into SIF occupies the same rhetorical position.

The Church of Scientology: tradecraft and the vetting failure

If the Unification Church supplies the template for influence, the Church of Scientology’s Operation Snow White supplies the template for tradecraft and for the failure of government to detect it. Between 1973 and 1977, the Church’s Guardian’s Office mounted what federal prosecutors and the sentencing court described as the single largest infiltration of the United States government by a private entity, placing operatives with forged credentials inside the Internal Revenue Service, the Department of Justice, the Drug Enforcement Administration, the Coast Guard intelligence service, and a United States Attorney’s office, among more than one hundred agencies (Urban 2011). Eleven senior officials, including Mary Sue Hubbard, were convicted of conspiracy, burglary of government offices, and theft of government property (Urban 2011).

There are two direct lessons here. The first is the insulation of the principal. L. Ron Hubbard was named an unindicted co-conspirator because the prosecution concluded that all direct communication ran through his wife rather than through him, leaving insufficient evidence to convict the man at the center (Urban 2011). The Guardian’s Office had, in other words, engineered deniability for its leader as a structural feature. The second lesson concerns the failure mode of vetting. Operatives bearing false identification sat inside sensitive federal offices for years before discovery. Snow White demonstrates that a closed, disciplined group will develop and deploy clandestine tradecraft comparable to a state intelligence service, and that the credentialing and personnel systems of the United States government are not intrinsically resistant to it. The relevance to a controller who refused to commit his directives to any medium attributable to himself, and who routed them through anonymized intermediaries, requires no elaboration.

Aum Shinrikyo: penetration of the security services and the radar-screen problem

The case of Aum Shinrikyo is instructive at the upper bound of the threat model and, more pointedly, on the question of detection. The 1995 staff study of the Senate Permanent Subcommittee on Investigations found that the cult had recruited scientists and technical experts to pursue chemical, biological, and nuclear weapons, had deployed sarin and VX, and, decisively for my argument, had “successfully infiltrated various levels of the Japanese government and industry including elements of its law enforcement and military” (U.S. Senate 1995). Members within the Japan Defense Forces passed the group advance warning of a planned police raid (U.S. Senate 1995). This is cult penetration of the cleared security establishment, documented by a committee of the United States Senate.

The study’s conclusion on detection is the sentence every counterintelligence operator should keep in mind. Despite the cult’s overt and far-flung activities, “not a single U.S. enforcement or intelligence agency perceived them as dangerous, much less a threat to national security,” prior to the Tokyo subway attack. In the words of one officer, “they simply were not on anybody’s radar screen” (U.S. Senate 1995). The institutional pathology Aum exposed was a fixation on official state proliferation that rendered a non-state, ideologically motivated actor effectively invisible to the apparatus. The Gabbard–Butler matter exposes the analogous blind spot, i.e., a vetting system oriented toward foreign handlers and financial inducements is structurally weak. It is poorly equipped to perceive a domestic cult of personality as a control threat, even when that cult exhibits the operational characteristics of one.

Rajneeshpuram and the Peoples Temple: the manipulation of democratic processes and the violence end-state

Two other cases bracket the behavioral repertoire of high-control groups in their relation to the state. The first is the Rajneeshpuram commune, whose leadership in 1984 deliberately contaminated salad bars at ten restaurants in The Dalles, Oregon, with Salmonella Typhimurium, sickening at least seven hundred fifty-one people, in a trial run intended to incapacitate the voting population and swing a county election (Török et al. 1997; Carus 2001). It remains the largest bioterrorist attack in United States history, and its target was the integrity of an American election. The relevance to the present case is the SIF apparatus’s documented operation of a network of inauthentic social media accounts, bearing false names and misappropriated avatar images, to defend and amplify Gabbard during her congressional years (Swaine 2026). The manipulation of democratic processes is squarely within the repertoire of such groups, and the inauthentic-account operation should be read in that light rather than as an isolated public relations excess.

The Peoples Temple case marks the terminal point of unchecked charismatic control over a population. In 1978, the Temple’s response to congressional oversight was the murder of Representative Leo Ryan on a Guyanese airstrip, followed by the deaths of more than nine hundred members (U.S. House 1979; Reiterman and Jacobs 1982). I am not citing Jonestown to suggest violence is imminent in the present matter. I am doing so in order to fix the outer boundary of what total psychological control of a population by a charismatic leader has produced in living American memory, a lesson that the federal government paid with the life of a sitting member of Congress. Underestimating such a group is an invitation to disaster.

NXIVM: the modern coercive-control and political-cultivation template

The most recent adjudicated precedent is NXIVM, whose leader Keith Raniere was convicted in 2019 in the Eastern District of New York on racketeering, sex trafficking, and related counts (U.S. DOJ 2019). NXIVM is the contemporary demonstration of three mechanisms relevant here. It combined coercive control with the systematic collection of “collateral,” compromising material held over members to ensure compliance, which is to say it manufactured the very blackmail vulnerability that counterintelligence fears. It deployed substantial private wealth and data operations toward the cultivation of political figures, including efforts directed at political circles abroad. And it demonstrated that a coercive-control organization will direct its capabilities toward access and influence as a matter of design. NXIVM establishes, in a federal record of conviction rather than mere allegation, that the threat model I am describing is not historical exotica but a live and recent feature of the American landscape.

Butler’s “tradecraft”: the concealment that converts influence into a counterintelligence problem

Everything above is prologue to the feature that, in my assessment, elevates the Gabbard–Butler matter from a troubling association to a counterintelligence nightmare, the controller’s tradecraft of concealment. Ordinary spiritual mentorship is conducted openly. What the record describes is the opposite, a sustained effort to exercise direction while defeating attribution.

Look at these elements in combination. Butler, by the account of the defector who produced the documents, does not use a computer. He delivered his directives verbally to secretaries who transcribed them, and the resulting memos were authored anonymously. The anonymity was described as intentional, designed to mask his identity if the documents ever surfaced (Swaine 2026). This is not the behavior of a teacher. It is the behavior of a principal practicing source protection. The use of human intermediaries to avoid committing direction to any attributable medium is a countersurveillance red alert, the functional equivalent of the cut-out in classical tradecraft. It succeeded to the point that a deputy could later step forward to claim authorship and thereby absorb attribution on the controller’s behalf (Swaine 2026). That the claim was defeated only by stylometric analysis demonstrates how close the concealment came to working.

Consider the management of disclosure as a deliberate question. The record includes an internal discussion in March 2015 about whether Gabbard should publicly admit she was Butler’s disciple (Swaine 2026). The relationship was CLEARLY understood, by the apparatus itself, as something to be managed and selectively concealed. This is corroborated by Gabbard’s own public conduct, which oscillated between private acknowledgment and public denial. In 2015 she acknowledged Butler as her guru at an ISKCON anniversary event and described him as her “beloved grandfather” and “spiritual master” (Science of Identity Foundation, in Wikipedia 2026; Sanneh 2017), yet in 2019, when asked directly whether Butler had been her political mentor, she answered, “No, no, not at all” (Bhasha Times 2026). When the New York magazine journalist Kerry Howley submitted questions about Butler, SIF, and related matters, Gabbard’s reply declined even to mention them (Civil Beat 2019). Concealment that is selective, deliberate, and sustained across years is not the signature of an innocent association. It is the signature of a relationship the parties knew would draw a shitstorm in the daylight.

The counterintelligence significance is structural. Butler’s intentions are irrelevant. A controlling node that is hidden is an unmonitored channel into the principal. An unmonitored channel into a cleared person is an attack surface available to any third party that discovers it. No one has to suspect that Butler is a foreign agent in order to recognize the peril. If a hostile service were to identify that a single organization could shape the conduct of a top U.S. I.C. official, the rational operational play would be to penetrate or pressure that organization. That would be my move, and there is precedent reaching all the way back to the Greeks of antiquity. The concealed controller is a vulnerability but more tragically, a force multiplier for any adversary sophisticated enough to notice him (and there was ample circumstantial evidence to do so). This is the precise logic the Fraser Committee applied to the KCIA’s exploitation of the Moon organization (U.S. House 1978), and it applies here with equal force.

Is there a Counterargument?

Intellectual honesty requires that the strongest objections be stated and answered. The first objection is religious, i.e., that a Hindu public figure’s deference to a guru is ordinary within a guru-shishya tradition of hundreds of millions of adherents. To pathologize it is bigotry (Shukla 2021). I am FINE with the premise and reject its bullshit application. The objection would be decisive if SIF were a mainstream Vaishnava lineage and if the relationship were open. It is neither. SIF is a breakaway personality cult that numerous former members describe as demanding absolute fealty and treating its founder as akin to a deity (Sanneh 2017; Swaine 2026), and the relationship at issue was concealed and publicly denied. As the Hindu American Foundation’s own propaganda puts it, a guru in the mainstream tradition “is a guide, not a master, and certainly not a controller” (Shukla 2021). This is specifically the distinction I am drawing here. The bigotry objection protects open spiritual practice. It does not protect a concealed directive channel. Conflating the two is itself a category error that the controller’s defenders have incentive to encourage.

The second objection is evidentiary, that the documents derive from a single defector with a financial motive, and that Gabbard’s office attributes the matter to a failed extortion attempt (Swaine 2026). The source’s motive is a legitimate. I am giving Gabbard the discount, but three factors raise the record WAY above bare single-source allegation. The volume is extraordinary, more than twenty-five thousand pages. The internal corroboration is strong in the documented sequence of directives followed by public acts. The independent stylometric attribution, defeating an affirmative false claim of authorship by the deputy, is the kind of forensic confirmation that fabrication does not readily survive (Swaine 2026; Mosteller and Wallace 1964). A disgruntled volunteer can lie. She can’t easily manufacture a decade of timestamped parallelism and a consistent authorial fingerprint matched to a separate lecture archive.

A third objection may be the most important and the most honest, that influence is not espionage, and that the documentary window closes in 2017, before Gabbard held national security office (Swaine 2026). Ok, fine. I have been careful not to allege a classified breach. My thesis here does not require one. The counterintelligence disaster is the demonstrated existence of a concealed, directive, deniable channel of external control over a person who subsequently received the highest access in the government, coupled with a vetting apparatus that failed to surface or act on a relationship documented across more than two dozen of her congressional decisions. The 2017 evidentiary boundary is itself part of the indictment, not a mitigation, because the proper governmental response to an unresolved control relationship is to establish whether it continued, and the public record gives no indication that this was ever done before her confirmation.

My Parting Thoughts

My call? With the caveats stated, the Gabbard–Butler matter satisfies the criteria for a counterintelligence disaster. The indicators are not ambiguous in their structure even where they remain contested in their details, i.e., a charismatic controller exercising directive influence over a principal’s legislation and public conduct; a channel built for deniability and protected by recognizable countersurveillance practice; a pattern of deliberate, selective concealment culminating in flat public denial; and a personnel security system that allowed the entire arrangement to reach the summit of the I.C. undetected or at the very least unappreciated. Both scenarios are equally galling because the sneakiness, denials and obfuscation should have been a glass-breaking moment.

The historical cases I have collected here establish that none of this is unprecedented in its parts. The Unification Church shows the cult as a foreign-exploited influence vehicle. Scientology shows the tradecraft and the vetting failure. Aum shows the penetration of cleared services and the radar-screen blindness. Rajneeshpuram shows a willingness to subvert democratic processes. The Peoples Temple shows the price already paid in a congressman’s life, and NXIVM shows the coercive-control and political-cultivation template alive in the present. What is unprecedented is the convergence of these elements in a single individual who held the office of Director of National Intelligence.

The appropriate response is an immediate retrospective damage assessment of the relevant tenure, an audit of the vetting file to determine whether this relationship was surfaced and overridden or simply missed, an inquiry into whether the directive relationship persisted past 2017, and an assessment of whether the controlling organization was itself ever a target of foreign penetration: these are the minimum measures the matter demands. A counterintelligence mechanism that declines to ask these questions because the controller wears the costume of a religion will have learned nothing from the cases above, each of which was, in its time, dismissed as somebody else’s eccentricity, . . . until it was not.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

Bibliography

  • Andrew, Christopher, and Vasili Mitrokhin. 1999. The Sword and the Shield: The Mitrokhin Archive and the Secret History of the KGB. New York: Basic Books.
  • Bhasha Times. 2026. “Documents Reveal How Guru Shaped Tulsi Gabbard’s Political Career.” June. https://www.bhashatimes.com/en/world/documents-reveal-guru-influence-tulsi-gabbard.
  • Boettcher, Robert, with Gordon L. Freedman. 1980. Gifts of Deceit: Sun Myung Moon, Tongsun Park, and the Korean Scandal. New York: Holt, Rinehart and Winston.
  • Carus, W. Seth. 2001. Bioterrorism and Biocrimes: The Illicit Use of Biological Agents Since 1900. Washington, DC: Center for Counterproliferation Research, National Defense University.
  • Honolulu Civil Beat. 2019. “NY Magazine Looks at Gabbard’s Science of Identity Foundation Background.” June. https://civilbeat.org/beat/ny-magazine-looks-at-gabbards-science-of-identity-foundation-background/.
  • Hassan, Steven. 1988. Combating Cult Mind Control. Rochester, VT: Park Street Press.
  • Lifton, Robert Jay. 1961. Thought Reform and the Psychology of Totalism: A Study of “Brainwashing” in China. New York: Norton.
  • Lifton, Robert Jay. 1999. Destroying the World to Save It: Aum Shinrikyo, Apocalyptic Violence, and the New Global Terrorism. New York: Metropolitan Books.
  • Mosteller, Frederick, and David L. Wallace. 1964. Inference and Disputed Authorship: The Federalist. Reading, MA: Addison-Wesley.
  • Nippon.com. 2026. “An Unholy Alliance: How the Unification Church Penetrated Japan’s Ruling Liberal Democratic Party.” January. https://www.nippon.com/en/japan-topics/c12101/.
  • Office of the Director of National Intelligence (ODNI). 2017. Security Executive Agent Directive 4: National Security Adjudicative Guidelines. Washington, DC: ODNI.
  • Reiterman, Tim, and John Jacobs. 1982. Raven: The Untold Story of the Rev. Jim Jones and His People. New York: Dutton.
  • Sanneh, Kelefa. 2017. “What Does Tulsi Gabbard Believe?” The New Yorker, November 6.
  • Shukla, Aseem. 2021. “When the New Yorker Otherized Tulsi Gabbard’s Faith.” Hindu American Foundation. https://www.hinduamerican.org/blog/when-the-new-yorker-otherized-tulsi-gabbards-faith/.
  • Singer, Margaret Thaler. 1995. Cults in Our Midst: The Hidden Menace in Our Everyday Lives. San Francisco: Jossey-Bass.
  • Swaine, Jon. 2026. “Tulsi Gabbard, Her Guru and the Mysterious Messages That Helped Shape Her Political Career.” The Washington Post, June 21. https://www.washingtonpost.com/investigations/2026/06/21/tulsi-gabbard-her-guru-mysterious-messages-that-helped-shape-her-political-career/.
  • Török, Thomas J., Robert V. Tauxe, Robert P. Wise, John R. Livengood, Robert Sokolow, Steven Mauvais, Kristin A. Birkness, Michael R. Skeels, John M. Horan, and Laurence R. Foster. 1997. “A Large Community Outbreak of Salmonellosis Caused by Intentional Contamination of Restaurant Salad Bars.” JAMA 278 (5): 389–395.
  • Urban, Hugh B. 2011. The Church of Scientology: A History of a New Religion. Princeton, NJ: Princeton University Press.
  • U.S. Department of Justice (U.S. DOJ). 2019. “NXIVM Leader Keith Raniere Convicted of Racketeering and Other Crimes.” Press release, Eastern District of New York, June 19.
  • U.S. House of Representatives. 1978. Investigation of Korean-American Relations: Report of the Subcommittee on International Organizations of the Committee on International Relations. 95th Cong., 2nd sess. Washington, DC: Government Printing Office.
  • U.S. House of Representatives. 1979. The Assassination of Representative Leo J. Ryan and the Jonestown, Guyana Tragedy: Report of a Staff Investigative Group to the Committee on Foreign Affairs. 96th Cong., 1st sess. Washington, DC: Government Printing Office.
  • U.S. Senate. 1995. Global Proliferation of Weapons of Mass Destruction: A Case Study on the Aum Shinrikyo. Staff Statement, Permanent Subcommittee on Investigations, Committee on Governmental Affairs. October 31. Washington, DC: Government Printing Office.
  • Wikipedia. 2026. “Science of Identity Foundation.” Accessed June. https://en.wikipedia.org/wiki/Science_of_Identity_Foundation.
Share this post:
Posted on

Señales de Advertencia del Agente Doble: Una Guía de Contrainteligencia

agente doble, inteligencia, contrainteligencia, espionaje, contraespionaje, espía, C. Constantin Poindexter Salcedo, seguridad nacional, DNI, CNI, CIA, DIA

Leyendo el señuelo (dangle): guía de campo del profesional sobre la fuente controlada y la reforma de la validación de activos. Un ensayo en la voz de un antiguo tipo de la CI.

Lo más difícil en la HUMINT no es reclutar una fuente. Es saber si la fuente que reclutaste te pertenece a ti. La reciente reconstrucción de fuente abierta (“OSINT”) que hizo Alexander Orleans del caso GTPROLOGUE (el despacho que el KGB hizo en 1987 del oficial de planta Aleksandr “Sasha” Zhomov contra la Estación de Moscú de la CIA) es la mejor anatomía pública en años de cómo un servicio hostil construye, en la frase de Churchill, una escolta de mentiras alrededor de una sola verdad operativa (Orleans 2025). A Zhomov lo corrieron durante aproximadamente tres años antes de que la CIA concluyera que había estado controlado desde el primer contacto. Lo instructivo del caso no es que engañaran a la CIA. Eso le pasa hasta a los mejores servicios. Es que el caso levantó casi todas y cada una de las banderas de advertencia clásicas. Las banderas se vieron, se debatieron, y el caso sobrevivió (Orleans 2025; Bearden y Risen 2003).

He compilado aquí un catálogo de trabajo de esas banderas y de otras tomadas de una literatura un poco más amplia, cada una anclada a un caso real, seguido de las mejoras que el mecanismo de contrainteligencia debería institucionalizar. He tratado de mantenerme tan cerca de la tradecraft real como lo permite el registro abierto. Nada de esto requiere acceso clasificado para entenderse. La verdad dolorosa es que los indicadores son bien conocidos y lo han sido por lo menos desde el tratamiento fundacional que F. M. Begoum le dio al agente doble en 1962 en Studies in Intelligence (Begoum 1962). Por desgracia, los seguimos reaprendiendo.

Los Indicadores

Producción desproporcionada al acceso. El indicio más duradero es una fuente que se sienta sobre una montaña de secretos y te entrega gravilla. Zhomov era un oficial de planta del Primer Departamento que supervisaba la vigilancia del jefe de estación de Moscú, y sin embargo afirmaba tener apenas un “acceso periférico o infrecuente” al mismísimo material que su puesto debía hacerle rutinario (Orleans 2025; Grimes y Vertefeuille 2012). Los soviéticos tenían una razón estructural para esto: la doctrina estricta prohibía liberar alimentación genuina de alto grado, y los oficiales temían un ajuste de cuentas estilo Stalin por divulgar de más, así que sus señuelos venían entrenados para alegar acceso escaso (Diamond 2008; Earley 1997). Cuando los reportes de una fuente quedan consistente y convenientemente por debajo del techo que su ubicación implica, pregúntate a quién beneficia el racionamiento.

La fuente controla el plan de comunicaciones y el tempo. El control es la capacidad del servicio que corre el caso de iniciar, alterar o detener el comportamiento del agente (Begoum 1962). Zhomov llegó con un plan de comunicaciones impersonal completamente formado —buzones de cartas a través del carro sin seguro de Downing, contacto a discreción de Zhomov, sin reuniones cara a cara prolongadas— que ponía cada palanca en manos del KGB e incluso restringía los movimientos físicos de sus manejadores de la CIA (Orleans 2025; Bearden y Risen 2003). Compárese con el estándar de oro del arreglo opuesto: el Comité XX británico en la Segunda Guerra Mundial, que poseía física y comunicacionalmente a cada agente alemán en el Reino Unido y por tanto podía alimentar a Berlín con confianza (Masterman 1972). Cuando el agente dicta la arquitectura del contacto, no lo estás corriendo a él. Él te está corriendo a ti.

Motivación delgada, genérica o sin respaldo. El espionaje contra el propio servicio es un acto psicológico profundo. Un activo o fuente creíble puede narrar de forma convincente por qué cruzó esa línea, y la historia se sostiene bajo verificación colateral. Zhomov ofreció el cliché de un sistema que se agriaba y un matrimonio en quiebra (y el interrogatorio independiente del desertor Sergey Papushin lo contradijo de plano, describiendo a Zhomov como felizmente casado y devoto de su hija) (Orleans 2025; Grimes y Vertefeuille 2012). Un motivo que no sobrevive a una segunda fuente no es un motivo; es una leyenda de cobertura.

La llegada “demasiado buena para ser cierta”. Los servicios hostiles leen tus brechas de recolección y las llenan a pedido. Zhomov apareció precisamente cuando la CIA estaba desesperada por explicar las catastróficas pérdidas de activos de 1985–86, con exactamente el acceso para “explicarlas” (Orleans 2025). “Demasiado bueno” y “cierto” no son mutuamente excluyentes. Los voluntarios espontáneos (walk-ins) genuinos sí ocurren en el peor momento posible; sin embargo, una oportunidad tan perfectamente a tono debería elevar la carga de la prueba, no bajarla (Johnson 2009). El desastre cubano es el monumento aleccionador aquí. Cuando el mayor Florentino Aspillaga Lombard desertó en Viena en junio de 1987, reveló que esencialmente cada cubano que la CIA creía haber reclutado desde principios de los años sesenta había sido un agente doble corrido por La Habana, que había mercadeado deliberadamente a sus oficiales como latinos aficionados para operar por debajo del radar (Latell 2012). Décadas de “éxitos” eran un solo engaño paciente.

Ninguna urgencia genuina por la exfiltración. Un hombre que dice que se quiere salir, y que está guardando su mejor material para su interrogatorio en suelo seguro, eventualmente debería preguntar: “¿Cuándo me voy?”. Zhomov nunca pidió un cronograma. Cuando finalmente le ofrecieron una ruta de exfiltración en 1990, la repudió por ser demasiado riesgosa y se fundió de vuelta en su equipo de vigilancia (Orleans 2025; Bearden y Risen 2003). El supuesto desertor que nunca quiere desertar está hablando mierda, no empacando su maleta de fuga.

Bona fides autovalidantes y alimentación que nunca hiere de verdad al servicio matriz. Una fuente controlada construye credibilidad con material que parece costoso pero no lo es. Zhomov entregó un padrón preciso de las pérdidas de 1985–86, dañino a primera vista, pero lo envolvió dentro de la falsa narrativa del SCD “cabrón e infalible” de que las pérdidas se debían a una tradecraft soviética brillante y no a un topo (Orleans 2025). La alimentación validaba el canal mientras protegía el secreto que el canal existía para proteger: Aldrich Ames. Escudriña si las “joyas de la corona” de tu fuente realmente le costaron algo a su servicio, o si cada divulgación adelanta calladamente los intereses de su servicio. Para ponerlo en lenguaje de riesgo: si no representa un peligro para el servicio matriz, no vale nada.

Errores de tradecraft de la oposición incompatibles con la competencia que reclama. Los reportes de Zhomov predecían una ola de señuelos del KGB. La CIA entonces vio al KGB correrlos tan chapuceramente que dos quedaron descaradamente expuestos como provocaciones. La Estación de Moscú racionalizó el desliz como descuido soviético endémico, sin notar nunca que la tradecraft descuidada era lógicamente irreconciliable con el SCD omnisciente del que Zhomov alardeaba (Orleans 2025). Un servicio no puede ser simultáneamente infalible y chapucero. Cuando el cuadro que pinta tu activo contradice el comportamiento que observas, créele a tus ojos.

La ventaja de jugar “en casa” en el área denegada. El entorno es en sí mismo un indicador porque moldea cuáles otros indicadores puedes siquiera poner a prueba. Todo el caso Zhomov se desenvolvió dentro de Moscú, donde el KGB controlaba la calle, impedía interrogatorios largos y podía rechazar cualquier reunión bajo el argumento incontestable de que no podía evadir a sus propios equipos de vigilancia (Orleans 2025). El resumen franco de Paul Redmond sobre la validación en área denegada —pocas o ninguna fuente colateral, fuerte dependencia del valor del material y de cómo empezó el caso, etc.— describe un problema que la oposición diseña deliberadamente (Redmond 2010). Un caso nacido y criado enteramente en terreno del adversario ha tenido sus opciones de validación estranguladas al nacer.

Resistencia a las pruebas operativas, y su jodido inverso que da miedo. Zhomov respondía las preguntas duras de verificación con respuestas que sus propios oficiales de contrainteligencia hallaban vagas o improbables, y se desviaba con la promesa de contarlo todo después de la extracción (Orleans 2025; Grimes y Vertefeuille 2012). La renuencia a ser puesto a prueba —la evasión del polígrafo, de las tareas provocadoras, de la “lista de compras” diseñada para atraparlo— es en sí misma reveladora e instructiva. Este indicador trae una advertencia que el caso GTPROLOGUE no provee, y que la profesión debe internalizar. La paranoia también quema a las fuentes reales. El manejo prolongado y brutal del desertor soviético Yuri Nosenko como presunta provocación, y la sospecha que casi le cuesta a la CIA al genuinamente invaluable general del GRU Dmitri Polyakov, son la patología igual y opuesta de la credulidad que protegió a Zhomov (Bagley 2007; Wise 1992). La validación es duda calibrada, no un reflejo en ninguna de las dos direcciones.

“El hambre”, y los incentivos que la alimentan. Orleans nombra al culpable silencioso: el apetito del oficial de caso por un golpe espectacular, la reticencia institucional a presionar una fuente deslumbrante lo bastante duro como para perderla (Orleans 2025). Redmond fue más franco, atribuyendo los fracasos de validación posteriores a Angleton en parte a oficiales que no creían que sus propios casos pudieran ser fabricados, “particularmente cuando había ascensos de por medio” (Redmond 2010). La catástrofe cubana hizo metástasis exactamente en este suelo: una voluntad organizacional de creer en reclutamientos que halagaban a los reclutadores (Latell 2012). La bandera más cara es la que elegimos no ver porque verla nos cuesta un logro de carrera.

Lo Que la Función de Contrainteligencia Debería Implementar

Los indicadores son necesarios pero no suficientes; una agencia que meramente los enumera será engañada igual, porque el caso Zhomov prueba que las banderas pueden estar ondeando y la operación aún sobrevivir. Las reformas de abajo se tratan de forzar a los indicadores a morder.

Institucionalizar la revalidación continua. La respuesta de la CIA a las quemas de los años ochenta fue el Sistema de Validación de Agentes, desarrollado a partir de 1987 e introducido formalmente al Directorio de Operaciones en 1991 (Mahle 2004; Olson 2019). El principio es sólido y debería ser doctrina en toda la comunidad: las bona fides establecidas una vez no quedan establecidas para siempre. Un activo debe ser recalificado en un calendario recurrente contra los seis métodos clásicos de validación: corroboración por otras fuentes, tareas específicas y pruebas operativas, recolección sobre el activo, polígrafo, penetración de su servicio matriz y vigilancia sobre él. Nada puede asumirse acerca de lo que le ha pasado a una fuente desde la última vez que se probó a sí misma (Orleans 2025; Olson 2019).

Separar al validador del manejador. El oficial que reclutó una fuente y el oficial que la certifica no deberían ser la misma persona, e idealmente no la misma cadena de mando. El hambre es un conflicto de interés; la estructura debe neutralizarlo dándole a una célula de contrainteligencia independiente la autoridad permanente de impugnar cualquier caso, con protección para el analista que disienta. El registro de GTPROLOGUE muestra que el sistema funcionaba a medias. Gerber y Redmond se mantuvieron escépticos y el equipo de contrainteligencia siguió planteando preocupaciones, pero esas preocupaciones fueron repetidamente subordinadas al deseo de no “hacerlo enojar” (Orleans 2025). La disidencia que puede ser anulada por los dueños del caso es un feo adorno de pared.

Tratar “controlado” como una hipótesis permanente por refutar. La disciplina de Richard Heuer del Análisis de Hipótesis en Competencia pertenece al centro de la validación. Enumera las hipótesis (de buena fe, fabricador, controlado), y pesa cada dato por su valor diagnóstico, qué tan bien discrimina entre ellas en lugar de qué tan bien encaja con la respuesta que quieres (Heuer 1999). La mayoría de las “bona fides” de Zhomov eran consistentes tanto con un voluntario genuino como con un señuelo. Tenían un valor diagnóstico casi nulo, y sin embargo se trataron como confirmación. Un activo que sobrevive un esfuerzo deliberado por probar que es hostil vale muchísimo más que uno del que simplemente nunca se dudó en serio.

Privilegiar la penetración de la oposición como el único validador decisivo. Esta es la lección escrita con sangre a lo largo de todos estos casos. A Zhomov lo desenmascaró un desertor, Papushin (Orleans 2025). El engaño cubano lo desenmascaró un desertor, Aspillaga (Latell 2012). Al propio Ames finalmente lo acorralaron con la ayuda de fuentes dentro del FIS ruso. La producción propia de una fuente literalmente nunca resuelve sus bona fides. El interior del servicio del adversario sí. Esto es precisamente por lo que Olson clasifica “Sé Ofensivo” como el primero de sus Diez Mandamientos de la Contrainteligencia. El reclutamiento de penetraciones y el manejo agresivo de agentes dobles no es un lujo sino el motor de la validación misma (Olson 2019).

Diseñar los incentivos contra “el hambre”. Este es, por supuesto, el argumento de calidad sobre cantidad. Si el ascenso premia el volumen de reclutamiento, los oficiales reclutarán, defenderán e inflarán. La contramedida correctiva es una cultura de evaluación de daños en la que sacar a la luz un fabricador o un caso controlado se trate como un éxito profesional y no como una “F”, y en la que el dinero pagado a una fuente se entienda como una inversión operativa, no como un costo hundido que hay que justificar (Orleans 2025).

Mis Reflexiones Finales

Zhomov fue, como concede Orleans, un trabajo sólido. Cada elemento, desde el escenario hasta la alimentación hasta el plan de comunicaciones, fue diseñado para tomar y retener la iniciativa (Orleans 2025). El caso también confirma, sin embargo, una máxima tan vieja como Begoum. La producción por sí sola nunca establece las bona fides, y ninguna métrica individual debería jamás eximir a una fuente del escrutinio continuo, y menos que nada una penetración potencial, que es la cosa más peligrosa de todas si resulta que pertenece al otro bando (Begoum 1962; Orleans 2025). La disciplina no es paranoia, que destruyó los años de Nosenko y casi la vida de Polyakov; ni es el hambre, que le entregó a La Habana un cuarto de siglo de victorias fantasma. Es la disposición a seguir poniendo a prueba a una fuente en la que quieres desesperadamente creer, y a tomar en serio al colega de la mesa que no deja de hacer la pregunta incómoda.

Todo pasa una vez por primera vez, incluido un oficial de planta lanzado como señuelo por un servicio que “nunca” lanzaría un oficial de planta como señuelo. El oficial de contrainteligencia que olvida esa oración está en algún lugar, ya siendo corrido.

~ C. Constantin Poindexter, MA en Inteligencia, Certificado de Posgrado en Contrainteligencia, JD, certificación OSINT CISA/NCISS, Certificación BFFOC del DoD/DoS

Bibliografía

  • Bagley, Tennent H. 2007. Spy Wars: Moles, Mysteries, and Deadly Games. New Haven, CT: Yale University Press.
  • Bearden, Milt, y James Risen. 2003. The Main Enemy: The Inside Story of the CIA’s Final Showdown with the KGB. New York: Random House.
  • Begoum, F. M. 1962. “Observations on the Double Agent.” Studies in Intelligence 6, no. 1: 57–72.
  • Diamond, John. 2008. The CIA and the Culture of Failure: U.S. Intelligence from the End of the Cold War to the Invasion of Iraq. Stanford, CA: Stanford Security Studies.
  • Earley, Pete. 1997. Confessions of a Spy: The Real Story of Aldrich Ames. New York: G. P. Putnam’s Sons.
  • Grimes, Sandra, y Jeanne Vertefeuille. 2012. Circle of Treason: A CIA Account of Traitor Aldrich Ames and the Men He Betrayed. Annapolis, MD: Naval Institute Press.
  • Heuer, Richards J., Jr. 1999. Psychology of Intelligence Analysis. Washington, DC: Center for the Study of Intelligence, Central Intelligence Agency.
  • Johnson, William R. 2009. Thwarting Enemies at Home and Abroad: How to Be a Counterintelligence Officer. Washington, DC: Georgetown University Press.
  • Latell, Brian. 2012. Castro’s Secrets: Cuban Intelligence, the CIA, and the Assassination of John F. Kennedy. New York: Palgrave Macmillan.
  • Mahle, Melissa Boyle. 2004. Denial and Deception: An Insider’s View of the CIA. New York: Nation Books.
  • Masterman, J. C. 1972. The Double-Cross System in the War of 1939 to 1945. New Haven, CT: Yale University Press.
  • Olson, James M. 2019. To Catch a Spy: The Art of Counterintelligence. Washington, DC: Georgetown University Press.
  • Orleans, Alexander. 2025. “Beautiful in Another Context: A Counterintelligence Assessment of GTPROLOGUE.” Studies in Intelligence 69, no. 2 (Extracts, June).
  • Redmond, Paul J. 2010. “The Challenges of Counterintelligence.” En The Oxford Handbook of National Security Intelligence, editado por Loch K. Johnson, 537–54. New York: Oxford University Press.
  • Wise, David. 1992. Molehunt: The Secret Search for Traitors That Shattered the CIA. New York: Random House.
Share this post:
Posted on

Deliberate Disarmament: How the United States is Systematically Dismantling its Disinformation Defenses

disinformation, information warfare, grey zone, influence operations, Russian FIS, psyops, intelligence, counterintelligence, DIA, CIA, NSA;

In the contemporary geopolitical landscape, the battle against disinformation has emerged as a critical front in maintaining national security and democratic integrity. It is hybrid warfare, plain and simple, . . . offensive operations in the “grey zone” the theorists like to call it. The United States has been systematically and purposefully disarming itself in this information warfare through a series of policy decisions and institutional changes that constitute nothing less than a strategic surrender. By examining the dismantling of counter-disinformation agencies, reduction of international alliances, constraints on broadcasting capabilities, prioritization of tech deregulation, and the purging of experienced intelligence personnel, my thoughts here demonstrate how these actions collectively represent a deliberate retreat rather than a mere series of isolated administrative changes. I am also going to share here my opinion on the implications of this unilateral disarmament for U.S. national security interests and the broader information ecosystem, concluding with a stark assessment of America’s vulnerability in an era of escalating information warfare.

The information environment has become a critical domain of modern warfare, where adversaries can achieve strategic objectives without firing a single shot. Russia’s 2026 budget allocation of $1.77 billion for propaganda efforts, supplemented by covert troll farms, front organizations, and cyber operations, demonstrates the seriousness with which state actors approach information warfare (Geraghty, 2026). Against this backdrop of escalating adversarial investment, the United States has paradoxically moved in the opposite direction, systematically dismantling its counter-disinformation infrastructure and capabilities in what can only be described as a deliberate act of strategic self-immolation.

My blog essay here examines how the United States has unilaterally disarmed itself in the information war through a series of deliberate policy choices that extend beyond mere administrative inefficiency to constitute a comprehensive strategic withdrawal. The evidence suggests this represents a fundamental recalibration of America’s approach to information warfare with profound and deeply troubling implications for national security. By examining the various dimensions of this disarmament, from institutional dismantling to personnel purges, we can better understand the emerging vulnerabilities in America’s information defenses and the strategic vacuum being created for adversaries to exploit.

The Systematic Dismantling of Counter-Disinformation Infrastructure

The most striking example of America’s unilateral disarmament in the information war is the systematic dismantling of its counter-disinformation infrastructure. The Trump administration has implemented policies that effectively prohibit federal agencies from combating misinformation or disinformation not tied to criminal activity, barring efforts that had previously been central to America’s information defense strategy (Nurick, 2026). This policy shift represents a fundamental reorientation of federal priorities away from proactive counter-disinformation work toward a reactive posture that only addresses disinformation when it rises to the level of criminal activity, a threshold that most sophisticated influence operations never cross.

The impact of this policy shift has been particularly devastating for agencies that had developed specialized expertise in tracking and countering foreign influence operations. The Global Engagement Center (GEC) at the State Department, which had been at the forefront of exposing Russian, Chinese, and Iranian disinformation campaigns, has seen its mandate severely constrained. Similarly, the Cybersecurity & Infrastructure Security Agency’s “Mis-, Dis-, and Malinformation Resource Library” has been effectively sidelined as part of a broader effort to scrub references to “misinformation” and “disinformation” from technical documents and official communications (Nurick, 2026). This linguistic cleansing reflects a deeper ideological opposition to the very concept of counter-disinformation as a legitimate government function.

Perhaps most alarmingly, the Trump administration has moved to politicize the research funding process that underpins America’s ability to understand and counter disinformation. A recent proposal would give political appointees at federal science agencies the role of approving all scientific research awards, replacing the traditional merit-based system determined by apolitical expert scientists (Lofgren, 2026). As Ranking Member Zoe Lofgren has warned, this move “would destroy what remains of merit-based review, dealing a crippling blow to science” and specifically targets research on topics deemed “politically inconvenient” (Lofgren, 2026). This politicization of research funding effectively ensures that studies of foreign disinformation campaigns and their effects will be starved of resources, leaving America blind to the very threats it should be countering.

The Purging of Expertise and Institutional Knowledge

The deliberate disarmament of America’s counter-disinformation capabilities extends beyond institutional structures to include the systematic purging of experienced personnel from key agencies. The Trump administration has targeted career intelligence analysts and counter-disinformation specialists for removal, replacing them with political loyalists lacking the specialized expertise necessary to understand and counter sophisticated influence operations. This personnel purging represents perhaps the most damaging aspect of America’s unilateral disarmament, as it destroys institutional knowledge that cannot be quickly rebuilt.

The impact of these personnel losses is particularly acute in the counterintelligence domain, where understanding adversary tactics and intentions requires years of specialized experience and the development of deep analytic tradecraft. The departure of these experts has left critical gaps in America’s ability to detect and counter foreign influence operations, creating vulnerabilities that adversaries have been quick to exploit. Even more troubling, the administration has attempted to require all current and future federal employees to sign loyalty oaths that effectively prioritize political alignment over professional expertise (PBS NewsHour, 2026). This approach ensures that the remaining counter-disinformation capabilities will be staffed by personnel selected for their political reliability rather than their analytic acumen.

The personnel purges have also disrupted the continuity of counter-disinformation efforts and severed critical professional networks. Many of the departed officials had developed deep expertise in specific adversary approaches and maintained professional relationships with their counterparts in other countries. Their departure has not only eliminated this expertise from government service but has also disrupted these critical networks and relationships, further isolating the U.S. from the broader counter-disinformation community. This isolation is particularly damaging given the transnational nature of modern influence operations, which require coordinated multinational responses to be effectively countered.

The Strategic Withdrawal from International Information Partnerships

The U.S. retreat from counter-disinformation extends beyond domestic institutions to include the weakening of international alliances and partnerships that had proven effective in combating foreign influence operations. The Trump administration’s “America First” approach has systematically undermined the collaborative frameworks that had been developed to share information about disinformation campaigns and coordinate responses across borders. This withdrawal from international partnerships represents a strategic miscalculation that leaves both the United States and its allies more vulnerable to foreign influence operations.

The impact of this withdrawal is already visible in the declining effectiveness of multinational initiatives like the EU vs Disinfo program and NATO’s strategic communications center, which had worked closely with U.S. agencies to expose Russian and Chinese influence operations. Without U.S. leadership and intelligence support, these partnerships have struggled to maintain their effectiveness against increasingly sophisticated adversaries. This is particularly damaging for smaller nations that lack the resources to develop their own counter-disinformation capabilities and have relied on U.S. support to counter foreign influence operations.

The strategic withdrawal from international partnerships is particularly concerning given the evolving nature of modern influence operations. As Russia, China, and other state actors have developed more sophisticated approaches to information warfare, they have increasingly targeted not just the United States but its allies and partners as well. By withdrawing from these partnerships, the United States has not only isolated itself but has also left its allies more vulnerable to influence operations that ultimately serve to undermine the broader Western alliance system. This strategic withdrawal represents a failure to recognize that information warfare is fundamentally a transnational threat that requires coordinated multinational responses.

The Constraining of Broadcasting and Public Diplomacy Capabilities

The constraints on Voice of America (VOA) and other international broadcasters represent a particularly damaging form of unilateral disarmament. These services had developed sophisticated approaches to reaching audiences in closed societies, often at great risk to their local partners and journalists. By providing independent news and information to audiences that otherwise lack access to unbiased reporting, these broadcasters served as a critical counterweight to state-sponsored propaganda and an important tool of public diplomacy.

The Trump administration has systematically undermined these broadcasting capabilities through budget cuts, leadership changes, and policy directives that have effectively neutered their ability to fulfill their missions. The administration has instructed managers to “reduce performance, . . . to the minimum presence and function required by law,” effectively gutting these organizations’ ability to conduct meaningful public diplomacy (Nurick, 2026). This approach stands in stark contrast to the investments being made by adversaries like Russia, which has expanded its RT network (a known Russian FIS propaganda channel forced to register as a foreign agent) from a traditional broadcaster to an entity with sophisticated cyber capabilities that conducts information operations and covert influence activities worldwide.

The constraining of U.S. broadcasting capabilities is particularly damaging in the context of modern authoritarianism, which increasingly relies on controlling information environments to maintain power. By limiting the ability of U.S. broadcasters to reach these audiences, the United States has effectively abandoned one of its most effective tools for supporting democratic aspirations and countering state propaganda. This retreat is particularly ironic given that these same broadcasters had been instrumental in countering Soviet propaganda during the Cold War—a historical precedent that suggests their current value should be recognized rather than diminished.

The Prioritization of Tech Deregulation Over Information Security

Another dimension of America’s unilateral disarmament in the information war is the prioritization of tech deregulation over information security. While private technology platforms have become the primary battleground for influence operations, the U.S. has moved toward reducing oversight rather than strengthening it. This approach reflects a fundamental misunderstanding of the role that technology platforms play in modern information warfare and the responsibility that both government and industry share for protecting the information ecosystem.

The Trump administration has consistently opposed regulation of technology platforms, even as evidence mounts that these platforms are being exploited by foreign actors to conduct influence operations. This deregulatory approach stands in stark contrast to the recognition by previous administrations that technology platforms play a critical role in both the dissemination of accurate information and the propagation of disinformation. By prioritizing deregulation over information security, the United States has effectively surrendered one of its most potent tools for countering foreign influence operations.

The impact of this deregulatory focus is particularly concerning given the evolving tactics of foreign influence operations. As state actors have developed more sophisticated approaches to information warfare, they have increasingly exploited the vulnerabilities of technology platforms to conduct influence operations at scale. Without adequate oversight and cooperation between government and technology companies, these platforms remain vulnerable to manipulation by foreign actors. The U.S. approach of prioritizing deregulation over information security effectively ensures that these vulnerabilities will remain unaddressed, creating significant opportunities for adversaries to exploit.

The Strategic Implications of Unilateral Disarmament

The cumulative effect of these various dimensions of unilateral disarmament is a significant reduction in America’s ability to compete in the information environment. This retreat has several deeply troubling strategic implications that extend beyond immediate tactical considerations to fundamental questions about America’s ability to protect its interests in an era of information warfare.

Unilateral disarmament creates asymmetries that adversaries can exploit with increasing effectiveness. While Russia, China, and other state actors continue to invest heavily in influence operations—with Russia alone allocating $1.77 billion to propaganda efforts in its 2026 budget—the United States has reduced its capabilities to counter these activities (Geraghty, 2026). This imbalance allows adversaries to shape narratives and influence public opinion with minimal resistance, creating strategic opportunities that they are already exploiting to advance their interests at America’s expense.

The U.S. withdrawal undermines the credibility of its commitments to allies and partners. The inability or unwillingness to maintain counter-disinformation capabilities raises questions about America’s reliability as a security partner, particularly for nations facing intense information warfare campaigns from adversaries. This credibility gap has already begun to reshape alliance dynamics, with some partners questioning whether they can count on U.S. support in the face of foreign influence operations. These doubts have broader implications for alliance cohesion and the ability of the United States to lead collective responses to shared security challenges.

Unilateral disarmament erodes America’s ability to protect its own democratic institutions from foreign influence. As foreign disinformation campaigns aim to “manipulate and weaken adversaries” through tactics designed to “discredit, divide, disarm, and demoralize them,” the United States becomes increasingly vulnerable to these influence operations (Geraghty, 2026). The January 6th Capitol attack and subsequent events have demonstrated how effectively foreign influence operations can exploit existing divisions within American society, a vulnerability that will only grow as counter-disinformation capabilities continue to be dismantled.

The Ideological Dimensions of the Disarmament Strategy

Perhaps most troubling about America’s unilateral disarmament in the information war is the ideological dimension that underlies these policy choices. The systematic dismantling of counter-disinformation capabilities appears to be driven not by pragmatic considerations of effectiveness or efficiency but by a fundamental ideological opposition to the very concept of government involvement in countering disinformation. This ideological opposition manifests in policies that prioritize political loyalty over expertise, deregulation over security, and isolation over cooperation.

The ideological dimensions of this disarmament strategy are particularly evident in the Trump administration’s approach to research funding and scientific expertise. By seeking to place political appointees in control of research funding decisions, the administration has demonstrated a preference for politically convenient narratives over evidence-based analysis (Lofgren, 2026). This approach extends to the very language used to discuss information warfare, with terms like “misinformation” and “disinformation” being systematically scrubbed from official documents and communications (Nurick, 2026). This linguistic cleansing reflects a deeper ideological opposition to acknowledging the existence and threat of foreign influence operations.

The ideological dimensions of the disarmament strategy are also evident in the administration’s approach to international partnerships and alliances. The systematic withdrawal from multinational counter-disinformation initiatives reflects not just a pragmatic assessment of costs and benefits but a deeper ideological opposition to collective approaches to security challenges. This “America First” approach assumes that the United States can effectively address information warfare threats on its own, despite abundant evidence to the contrary. This ideological isolationism leaves America more vulnerable to influence operations while simultaneously undermining the collective security architecture that had been developed to counter these threats.

The Path to Strategic Vulnerability

The evidence that I have presented in this piece demonstrates that the United States has been systematically and purposefully disarming itself in the war on disinformation. Through the dismantling of counter-disinformation agencies, cutting of international alliances, constraints on broadcasting capabilities, prioritization of tech deregulation, banning of funding for independent researchers, and purging of experienced intelligence personnel, the U.S. has created significant vulnerabilities in its information defenses.

This unilateral disarmament is particularly concerning given the escalating investments by adversaries in influence operations. As Russia’s 2026 budget allocation of $1.77 billion for propaganda efforts demonstrates, state actors are increasingly viewing the information environment as a critical domain of warfare (Geraghty, 2026). The U.S. retreat from this domain represents not just a strategic miscalculation but a deliberate surrender with profound implications for national security and the future of democratic governance.

Reversing this unilateral disarmament will require more than simply restoring previous programs and initiatives. It will require a fundamental reorientation of America’s approach to information warfare. This must include rebuilding counter-disinformation capabilities, restoring international partnerships, redeveloping expertise in countering foreign influence operations, and most importantly, rejecting the ideological opposition to government involvement in countering disinformation. Until such efforts are undertaken, the United States will remain at a significant disadvantage in the information environment, unable to effectively counter the sophisticated influence operations being conducted by its adversaries.

The stakes in this information war could not be higher. As foreign actors continue to exploit America’s self-inflicted vulnerabilities, the very foundations of democratic governance are at risk. The unilateral disarmament of America’s counter-disinformation capabilities represents not just a strategic retreat but a betrayal of the government’s fundamental responsibility to protect the nation from foreign threats, both conventional and informational, and both foreign and domestic. So pronounced is the betrayal that experienced elements in the U.S. Intelligence Community, addressing the malign information operations of Russian FIS as an example, have stated clearly, “We couldn’t do a worse job if Putin himself was sitting in the White House and giving orders.” Without a course correction, the United States will continue to cede the information environment to its adversaries, with consequences that will reverberate for generations to come.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

Bibliography

  • Geraghty, Jim. 2026. “In the disinformation war, the U.S. unilaterally disarmed.” The Washington Post, May 26.
  • Lofgren, Zoe. 2026. “Ranking Member Lofgren Slams Trump Administration for Plan to Politicize Research Funding Process, Undermine Expert Review.” House Committee on Science, Space, and Technology Democrats, May 29.
  • Nurick, Jacob K. 2026. “The Trump administration’s goals, outlined in Project 2025, were to weaken federal…” Facebook post, April 15.
  • PBS NewsHour. 2026. “The Trump administration wants all current and future federal…” Facebook post, March 22.
  • Myers, Steven Lee. 2026. “Trump Officials Try to Fight Foreign Disinformation They Once…” The New York Times, April 1.

Share this post:
Posted on

When the Watchers Get Watched: The FBI Wiretap Breach

When the Watchers Get Watched: What the FBI Wiretap Breach Means for Everyone Else, FBI, CIA, DNI, C. Constantin Poindexter, counterintelligence, counterespionage, covert action

The compromise of the Federal Bureau of Investigation’s wiretap infrastructure by Chinese state-sponsored hackers represents not merely a cybersecurity failure but a fundamental counterintelligence catastrophe that demands immediate strategic reassessment. The Salt Typhoon intrusion, attributed to China’s Ministry of State Security (MSS), exploited the very systems mandated by the Communications Assistance for Law Enforcement Act (CALEA) to transform America’s lawful intercept capabilities into an open door for adversarial intelligence collection. While public discourse has focused on the compromise of political communications and the exposure of millions of Americans’ metadata, the counterintelligence community must confront a more insidious implication: by accessing the target lists and surveillance parameters within FBI wiretap systems, Chinese FIS likely have obtained a roadmap to their own compromised operatives, informants, and recruitment networks (NBC News 2025; Nextgov/FCW 2025).

The technical architecture of the breach reveals a systemic vulnerability that has persisted for years. Salt Typhoon operators infiltrated at least nine major U.S. telecommunications providers, including AT&T, Verizon, and Lumen, maintaining persistent access since approximately 2019 (Wikipedia 2025; Nextgov/FCW 2025). The exploitation vector was not sophisticated zero-day weaponry but rather the CALEA-mandated lawful intercept systems themselves—backdoors engineered into telecom infrastructure to facilitate court-authorized surveillance. As Senator Maria Cantwell noted in December 2025 Senate Commerce Committee hearings, “They exploited the wiretapping system that our law enforcement agencies rely on under CALEA. These systems became an open door for Chinese intelligence” (U.S. Senate Committee on Commerce, Science, & Transportation 2025). The hackers leveraged outdated equipment, unpatched router vulnerabilities with patches available for seven years, and weak credential management to establish a persistent presence across carrier networks (U.S. Senate Committee on Commerce, Science, & Transportation 2025).

The counterintelligence dimension of this compromise extends far beyond the immediate theft of communications data. When Salt Typhoon accessed FBI wiretap systems, they potentially obtained the target lists, identifying which individuals, phone numbers, and accounts were subject to active or pending surveillance authorizations. This intelligence bonanza enables Chinese services to identify which of their operatives, assets, and informants have been compromised by U.S. counterintelligence, which recruitment networks have been penetrated, and which communication channels have been compromised (UMBC 2025; The Conversation 2025). As one security analysis noted, “By compromising lawful intercept systems, Chinese intelligence operatives gained visibility into which of their agents and informants were under U.S. surveillance, knowledge that can help those targets try to evade such surveillance” (InstaTunnel 2025).

The implications for HUMINT operations are devastating. Every target list compromised represents potential exposure of recruited assets, informants who have provided critical intelligence, and the methods by which U.S. counterintelligence identifies foreign operatives. Chinese intelligence can now cross-reference these lists against their own personnel databases, identify personnel who may have been turned or are under suspicion, and take protective measures ranging from enhanced surveillance of suspected leaks to elimination of compromised assets. The damage is not merely retrospective. It is prospective. Future counterintelligence operations against Chinese targets will face heightened suspicion that their targets have been alerted to surveillance through this compromise.

The scope of the intelligence loss is staggering. FBI assessments indicate Salt Typhoon targeted over 80 countries and compromised approximately 600 organizations (Nextgov/FCW 2025; The Record 2025). While fewer than 100 individuals had actual call content and text messages directly intercepted, the metadata exposure and geolocation tracking affected millions (InstaTunnel 2025). High-profile targets included then-presidential candidate Donald Trump, Vice Presidential candidate JD Vance, and the staff of the Kamala Harris campaign, clearly demonstrating the group’s willingness to target the highest levels of American political leadership (Wikipedia 2025; Axios 2024). The interception of unencrypted text messages and audio recordings from these targets represents not merely political espionage but a demonstration of capability that sends a clear signal about Chinese reach into American communications infrastructure.

Senate Intelligence Committee leadership has characterized the breach in apocalyptic terms. Senator Mark Warner, Vice Chairman of the Senate Select Committee on Intelligence, called Salt Typhoon the “worst telecom hack in our nation’s history” (Lawfare 2025). Former FBI Director Christopher Wray described it as the “most significant cyber espionage campaign in history” (Lawfare 2025). These assessments reflect not merely the scale of the compromise but its strategic implications: the demonstrated ability of Chinese intelligence to penetrate the infrastructure underlying American signals intelligence and law enforcement surveillance capabilities.

The FBI’s formal designation of the wiretap compromise as a “major cyber incident” under federal data security law acknowledges the severity of the breach. Such designation applies only to compromises involving personally identifiable information that could cause “demonstrable harm” to national security interests, foreign relations, or civil liberties (NBC News 2025; HSToday 2025). The Bureau’s April 2025 offer of a $10 million reward for information leading to Salt Typhoon operator identification underscores the ongoing nature of the threat and the difficulty of attribution in state-sponsored operations (Breached.Company 2025).

From a counterintelligence perspective, the Salt Typhoon compromise demands a fundamental reassessment of how lawful intercept capabilities are architected and secured. The CALEA mandate created a centralized surveillance infrastructure that, while facilitating legitimate law enforcement needs, simultaneously created a high-value target for adversarial exploitation. The security of these systems was predicated on the assumption that telecommunications providers would implement “rudimentary cybersecurity measures”—an assumption that proved catastrophically unfounded (U.S. Senate Committee on Commerce, Science, & Transportation 2025).

The ongoing remediation challenges compound the counterintelligence damage. As of December 2025, telecom companies infiltrated in the attack had failed to prove that Chinese hackers had been eradicated from their networks (U.S. Senate Committee on Commerce, Science, & Transportation 2025). The November 2025 FCC decision to roll back cybersecurity regulations implemented after Salt Typhoon—championed by Chairman Brendan Carr—has drawn sharp criticism from security experts who note that vulnerabilities “are still being exploited” (U.S. Senate Committee on Commerce, Science, & Transportation 2025). This regulatory environment suggests that the conditions enabling Salt Typhoon’s initial penetration persist, raising the specter of continued or renewed compromise.

For the counterintelligence practitioner, the lessons of Salt Typhoon are clear and troubling. First, the lawful intercept infrastructure designed to support counterintelligence operations has become a liability, potentially compromising the very operations it was meant to enable. Second, the persistence of Chinese access since 2019 suggests that counterintelligence targeting of Chinese operatives during this period may have been visible to adversary services. Third, the inability to confirm remediation means that current and future operations remain at risk of exposure through compromised infrastructure.

The Salt Typhoon breach represents a paradigm shift in counterintelligence operations. When the watchers’ own surveillance infrastructure becomes the vector for adversarial intelligence collection, traditional operational security models collapse. The counterintelligence community must now operate under the assumption that Chinese intelligence possesses visibility into historical FBI target lists and may possess ongoing access to surveillance parameters. This requires not merely technical remediation but operational adaptation: reassessment of ongoing investigations, validation of asset security, and development of surveillance methodologies that do not rely on compromised infrastructure.

The breach also carries implications for allied intelligence sharing. The FBI assessment that Salt Typhoon targeted over 80 countries suggests that the compromise extends beyond American networks to allied telecommunications infrastructure (Nextgov/FCW 2025; The Record 2025). Allied counterintelligence services must now assess whether their own lawful intercept capabilities have been similarly compromised and whether shared targeting information has been exposed to Chinese intelligence.

The Salt Typhoon compromise of FBI wiretap infrastructure represents a watershed moment in cyber-enabled counterintelligence. The transformation of lawful intercept systems from tools of surveillance to vectors of exposure demonstrates the fundamental vulnerability of centralized surveillance architectures in an era of persistent cyber threats. For the counterintelligence community, the challenge is not merely technical remediation but strategic adaptation: developing operational methodologies that assume adversarial FIS’s visibility into surveillance infrastructure while maintaining the capability to identify and neutralize foreign intelligence threats. Compromising Red Hook is only one of a myriad of penetrations, . . . the alarm is blinking red. The watchers have been watched, and the counterintelligence implications of that reversal should frighten everyone.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

Bibliography

  • Axios. 2024. “China-backed Salt Typhoon spied on politicians phones for months: reports.” Axios, October 29. https://www.axios.com/2024/10/29/salt-typhoon-targets-politicians-phones.
  • Breached.Company. 2025. “FBI Wiretap Systems Compromised: Inside Salt Typhoon’s Infiltration of America’s Lawful Intercept Infrastructure.” Breached.Company, April. https://breached.company/fbi-wiretap-systems-compromised-salt-typhoon-lawful-intercept/.
  • HSToday. 2025. “FBI Labels China-Linked Hack of Surveillance System a ‘Major Cyber Incident.'” Homeland Security Today, April 1. https://www.hstoday.us/fbi/fbi-labels-china-linked-hack-of-surveillance-system-a-major-cyber-incident/.
  • InstaTunnel. 2025. “Salt Typhoon: When State-Sponsored Hackers Infiltrate Telecom Infrastructure.” Medium, January. https://medium.com/@instatunnel/salt-typhoon-when-state-sponsored-hackers-infiltrate-telecom-infrastructure-8d8aeb5ce19c.
  • Lawfare. 2025. “Reconfiguring U.S. Cyber Strategy in the Wake of Salt Typhoon.” Lawfare, January. https://www.lawfaremedia.org/article/reconfiguring-u.s.-cyber-strategy-in-the-wake-of-salt-typhoon.
  • NBC News. 2025. “FBI labels suspected China hack of law enforcement data ‘a major cyber incident.'” NBC News, April 1. https://www.nbcnews.com/news/us-news/fbi-labels-suspected-china-hack-law-enforcement-data-major-cyber-incid-rcna266495.
  • Nextgov/FCW. 2025. “Salt Typhoon hackers targeted over 80 countries, FBI says.” Nextgov/FCW, August 27. https://www.nextgov.com/cybersecurity/2025/08/salt-typhoon-hackers-targeted-over-80-countries-fbi-says/407719/.
  • The Conversation. 2025. “What is Salt Typhoon? A security expert explains the Chinese hackers and their attack on US telecommunications networks.” The Conversation, January. https://theconversation.com/what-is-salt-typhoon-a-security-expert-explains-the-chinese-hackers-and-their-attack-on-us-telecommunications-networks-244473.
  • The Record. 2025. “Allied spy agencies blame 3 Chinese tech companies for Salt Typhoon attacks.” The Record from Recorded Future News, January. https://therecord.media/allied-spy-agencies-blame-chinese-companies-salt-typhoon.
  • UMBC (University of Maryland, Baltimore County). 2025. “What Is Salt Typhoon? A Security Expert Explains The Chinese Hackers And Their Attack On US Telecommunications Networks.” UMBC News, January. https://umbc.edu/stories/what-is-salt-typhoon-a-security-expert-explains-the-chinese-hackers-and-their-attack-on-us-telecommunications-networks/.
  • U.S. Senate Committee on Commerce, Science, & Transportation. 2025. “Experts Agree U.S. Communications Networks Remain Vulnerable Following Salt Typhoon Hack.” Senate Commerce Committee Press Release, December 2. https://www.commerce.senate.gov/2025/12/experts-agree-u-s-communications-networks-remain-vulnerable-following-salt-typhoon-hack.
  • Wikipedia. 2025. “Salt Typhoon.” Wikipedia, last modified January. https://en.wikipedia.org/wiki/Salt_Typhoon.
Share this post:
Posted on

Operation Merlin: A D&D Failure by Strategic Compromise

Operation Merlin, denial and deception, d and d, intelligence, counterintelligence, espionage, counterespionage, HUMIN, C. Constantin Poindexter, CIA, NSA, DIA

Operation Merlin: A Denial and Deception Case Study in Covert Sabotage and the Anatomy of a Strategic Blunder of Enormous Proportions

Operation Merlin was a clandestine CIA program designed to undermine Iran’s nuclear weapons development program by inserting deliberately sabotaged warhead component blueprints through a recruited human asset. Executed from approximately 1998 through the early 2000s, the operation was an ambitious attempt at deception against a state-level nuclear proliferator. I am going to share my thoughts here about Operation Merlin through the lens of Denial and Deception (D&D) doctrine, evaluate its design, execution, and compromise against accepted deception planning frameworks. Drawing on trial exhibits from United States v. Sterling (2015), investigative reports, and foundational D&D literature, my opinion is that Operation Merlin, while possessing a sound deception concept, suffered from catastrophic failures in channel selection, feedback architecture, operational security, and post-compromise institutional decision-making that collectively rendered it not merely ineffective but potentially counterproductive to the national security interests it was designed to serve.

I. Introduction: Deception as Counterproliferation

The use of deception as a counterproliferation tool occupies an uncomfortable space in American intelligence history. Unlike tactical battlefield deception or strategic wartime misdirection, i.e., domains in which the United States and its allies developed sophisticated doctrinal frameworks during the Second World War, deception operations targeting foreign weapons programs operate in a gray zone where the consequences of failure are measured not in lost engagements but in accelerated existential threats. Operation Merlin sits at the center of this tension: an operation whose architects understood the strategic imperative but whose execution betrayed a fundamental misapprehension of the doctrinal requirements for successful material deception against a sophisticated state adversary.

To offer a robust eveluation of Merlin, we need to move beyond the narrative of its public exposure (the prosecution of CIA case officer Jeffrey Sterling, the journalism of James Risen, the spectacle of a federal trial in which CIA operatives testified behind seven-foot partitions) and instead subject the operation to the same analytical framework that professional deception planners apply to their own work. This essay applies the six-element D&D planning framework derived from Barton Whaley’s foundational taxonomy in Stratagem: Deception and Surprise in War (Whaley, 2007), Richards Heuer’s cognitive analytical model from Psychology of Intelligence Analysis (Heuer, 1999), and the operational principles codified in Joint Publication 3-13.4, Military Deception (Joint Chiefs of Staff, 2012), supplemented by the historical precedent of the XX Committee’s Double Cross System as the benchmark for successful material deception at scale.

II. Strategic Context and the Deception Concept

By the late 1990s, the U.S. Intelligence Community assessed with growing confidence that Iran was pursuing nuclear weapons capability, though the evidentiary basis for this assessment remained contested internally. The 2001 National Intelligence Estimate, the first to formally conclude that Iran was working toward a nuclear weapon, was later characterized by Paul Pillar, then the CIA’s National Intelligence Officer for the Near East and South Asia, as resting on “a matter of inference” rather than direct evidence (Porter, 2014). Nevertheless, the policy imperative to disrupt Iran’s nuclear trajectory was acute, and the menu of available options was constrained by the absence of a viable military target set and the diplomatic limitations of the post-JCPOA environment that would not materialize for another fifteen years.

Into this gap stepped the CIA’s Directorate of Operations with a proposal rooted in material deception: recruit a Russian nuclear scientist with legitimate technical credentials, provide him with doctored blueprints for a nuclear warhead firing set, and direct him to deliver these blueprints to Iranian officials under the legend of a mercenary walk-in seeking financial compensation for proliferation-grade technical intelligence (Risen, 2006).

Within Whaley’s taxonomy, this concept falls squarely under the category of “mimicking”, creating a false artifact that imitates a real one closely enough to be accepted as authentic by the target (Whaley, 2007). The doctored blueprints were not fabrications from whole cloth; they were based on genuine Russian weapons designs, modified to contain dozens of hidden engineering flaws that would cause any device constructed from them to fail. The deception’s success depended on the flaws being sufficiently subtle to evade detection by Iranian scientists while being sufficiently fundamental to render the resulting weapon inoperable.

The concept was sound. Material deception (the introduction of fabricated or corrupted physical artifacts into an adversary’s intelligence or procurement stream ) has a long and occasionally successful history, from Operation Mincemeat’s fictitious invasion plans in 1943 to the CIA’s Cold War-era contamination of Soviet technical collection channels. The critical question was never whether the concept could work in principle, but whether the CIA possessed the operational infrastructure, tradecraft discipline, and institutional patience to execute it against a counterintelligence-aware adversary like Iran.

III. Operational Design and Execution

The operation’s centerpiece was a human asset — a Russian nuclear engineer recruited by the CIA and referred to at trial under the cryptonym “Merlin” (United States Department of Justice [USDOJ], 2015). Merlin possessed genuine scientific credentials, making him a plausible vector for the delivery of proliferation-grade material. His CIA handler from November 1998 through May 2000 was case officer Jeffrey Alexander Sterling, who managed the asset relationship and coordinated the operational logistics of the delivery (USDOJ, 2015).

The delivery was designed to exploit a known vulnerability in Iran’s procurement architecture: its reliance on intermediaries and walk-in sources for weapons-relevant technical intelligence. Merlin was directed to approach Iran’s mission to the International Atomic Energy Agency (IAEA) in Vienna, Austria, and provide an incomplete set of the doctored blueprints. The incompleteness was deliberate. It created an incentive structure requiring the Iranians to re-contact Merlin for the remaining schematics, thereby confirming acceptance of the bait and potentially opening a sustained intelligence collection channel into Iran’s nuclear procurement apparatus (Risen, 2006).

Former National Security Adviser Condoleezza Rice testified at Sterling’s trial that the program was “one of the only levers we had to try to disrupt Iran’s nuclear program” and characterized it as among the government’s “most closely held secrets” (Barakat, 2015). Rice further stated that she personally intervened with the New York Times to suppress publication of a story about the operation, arguing that exposure could result in catastrophic loss of life (Gerstein, 2015).

The execution in February 2000 deviated significantly from the operational plan. Merlin’s testimony at trial revealed that he had difficulty locating the Iranian mission in Vienna. When he found it, no one answered the door. He ultimately placed the envelope containing the blueprints in a mailbox and covered it with a newspaper (Solomon, 2015). Additionally, Merlin deviated from his handlers’ instructions regarding the contact mechanism: rather than providing an American mailing address as directed, he substituted an email address, reasoning that an American postal address would appear suspicious to Iranian counterintelligence and could be traced back to him (Solomon, 2015).

These deviations carry BIG implications when evaluated against D&D doctrine. An asset who autonomously modifies operational parameters based on his own risk calculus (however rational that calculus may be) introduces uncontrolled variables into the deception architecture. More critically, Merlin’s technical competence, which made him a credible channel, simultaneously made him capable of evaluating the material he was tasked to deliver. According to Risen’s account, Merlin recognized the deliberate flaws in the schematics and transmitted his belief along with the delivery which signaled to the Iranians that the blueprints were intelligence service-manufactured, allowing Iranian scientists to identify and discard the sabotaged elements while extracting legitimate technical data (Risen, 2006). Merlin denied these characterizations under oath, testifying that Risen’s depiction of him as reluctant was “completely untrue” (Solomon, 2015). The divergence itself is analytically significant: if Risen’s source was not Merlin, then whoever provided those details possessed the kind of intimate operational knowledge consistent with a case officer’s access.

IV. D&D Doctrinal Evaluation

A. Desired Perception

The foundational requirement of any deception operation is a clearly defined desired perception, i.e., the specific belief the operation is designed to induce in the target’s mind (Joint Chiefs of Staff, 2012). Operation Merlin’s desired perception was straightforward: that the blueprints were genuine proliferation material obtained through an illicit procurement channel (a disgruntled or mercenary Russian scientist selling weapons knowledge for financial gain).

This perception was plausible on its face. Russian nuclear scientists in the post-Soviet period were documented to be underpaid, underemployed, and in some cases actively solicited by proliferating states. The desired perception exploited a real phenomenon, which is doctrinally correct. The most effective deceptions are those anchored in patterns the target already recognizes and expects (Heuer, 1999). Assessment: Adequate.

B. The Deception Story

The constructed narrative, a Russian scientist approaching Iran’s IAEA mission as a walk-in, offering warhead-grade schematics for money, was coherent as a standalone legend. Walk-in approaches by foreign nationals offering technical intelligence were not unprecedented in proliferation networks.

However, there is no indication in the trial record that the CIA subjected this story to rigorous adversarial analysis “red-teaming” we call it. The planners missed specifically examining how Iran’s Ministry of Intelligence and Security (VEVAK) would process and evaluate a cold-approach walk-in offering firing set blueprints. VEVAK had extensive institutional experience identifying Western intelligence provocations, and a walk-in of this nature. An unsolicited player offering the single most sensitive category of weapons data, with no prior relationship or established bona fides would have triggered significant counterintelligence scrutiny. The absence of documented red-team analysis suggests the deception story was evaluated for internal plausibility rather than adversarial resilience. Assessment: Deficient.

C. Channel Selection

D&D doctrine, codified in lessons from the London Controlling Section’s World War II operations and subsequent CIA and DoD guidance, instructs that the credibility of the delivery channel is the single most critical variable in material deception. The channel must be one that the adversary already trusts or is predisposed to trust, typically because the source has previously provided verified intelligence, is embedded in a network the adversary already exploits, or mimics an approach pattern the adversary has successfully used before (Holt, 2004).

From Iranian FIS’s perspective Merlin possessed none of these attributes . He was an unknown entity conducting a cold approach. His operational execution was amateurish, i.e., unable to locate the mission, leaving material in an unattended mailbox, etc.. From an Iranian counterintelligence officer’s perspective, applying the analytical principles Heuer articulated, the approach contained no prior cognitive anchor that would predispose acceptance (Heuer, 1999). The channel was cold, unvetted from the target’s vantage point, and operationally clumsy.

Taking a lesson from history, the Double Cross System is instructive. The XX Committee’s deception channels, turned German agents who fed disinformation to the Abwehr, were effective precisely because they were channels the adversary had already accepted and validated through prior intelligence exchanges. Double Cross built credibility over months and years of carefully calibrated true-false reporting mixtures before introducing critical strategic deceptions like FORTITUDE. Operation Merlin attempted to deliver the equivalent of FORTITUDE-grade material through a channel with zero established credibility. Assessment: Critically Deficient.

D. Feedback Architecture

The operation’s feedback mechanism was its most elegant design element: the deliberate incompleteness of the blueprints created a natural trigger requiring Iran to re-contact Merlin for the remaining schematics, thereby confirming acceptance.

The problem was singular and fatal: Iran never responded. This silence created an analytical void that the operation had no means to resolve. The CIA could not determine whether Iran had detected the deception and discarded it, had accepted the material but chose to develop it independently, had never routed the material to a competent analyst, or whether VEVAK had flagged the approach as a provocation and filed it as a counterintelligence reference.

Well-designed deception operations maintain redundant feedback mechanisms precisely to prevent this kind of interpretive paralysis. The Double Cross System’s feedback architecture, continuous monitoring of German assessments through ULTRA decrypts of Abwehr and OKW communications, allowed deception planners to observe in near-real-time whether their false intelligence was being accepted, rejected, or partially integrated, and to adjust their deception stories accordingly (Howard, 1995). Operation Merlin had a single feedback point, and when that point went silent, the operation was effectively blind. No secondary collection mechanism (SIGINT, HUMINT from other sources inside Iran’s nuclear apparatus, or technical surveillance of Iranian procurement activity) was established to provide independent confirmation of the operation’s effect. Assessment: Critically Deficient.

E. Adaptability

Nothing in the trial record indicates that the CIA developed contingency plans for the various failure modes the operation might encounter — Iranian detection, asset compromise, the asset’s autonomous deviation from instructions, or operational exposure through internal security breaches. The reassignment of Sterling in May 2000 without documented succession planning or compartmentation review further suggests that continuity of operations planning was inadequate (USDOJ, 2015). He was the only player with intimate knowledge of the asset. When Sterling subsequently entered an adversarial posture with the agency, there was no adaptive mechanism to contain the resulting vulnerability. Assessment: Critically Deficient.

F. Operational Security

This is where Operation Merlin became a catastrophic F.U. The universe of individuals with knowledge of the operation expanded and expanded. The President, the National Security Adviser, senior CIA leadership, multiple case officers, the Russian asset and his wife, and after Sterling raised concerns through ostensibly proper channels, staffers on the Senate Select Committee on Intelligence knew it all. Each additional read-in was a point of compromise.

The most fundamental security failure was personnel-related. Sterling possessed direct, intimate knowledge of the operation, the asset’s identity, the tradecraft, and the operational dynamics. He was reassigned and then, within three months, became an Agency “adversary”. Counterintelligence doctrine requires enhanced monitoring of personnel with access to sensitive compartmented information who demonstrate indicators of potential unreliability. That would ABSOLUTELY include legal disputes with the employing I.C. agency. There is no indication that any such monitoring was implemented (Gerstein, 2015; Solomon, 2015). Assessment: Catastrophically Deficient.

V. The Vectors of Compromise

Operation Merlin was compromised through three distinct vectors, each representing a failure at a different level of the D&D security architecture.

The asset’s autonomous judgment constituted the first vector. Merlin’s technical competence, the very attribute that made him a credible channel, enabled him to evaluate and potentially undermine the material he was tasked to deliver. This is a structural paradox inherent in using technically sophisticated assets for material deception: the more credible the channel, the more capable it is of detecting and subverting the deception it carries.

The case officer’s grievance constituted the second vector. The prosecution established through communications metadata that Sterling and Risen were in contact during the periods preceding and following the publication of State of War, i.e., phone calls to Risen’s residence, emails containing articles related to Sterling’s former operational portfolio, and continued contact from December 2003 through November 2005 (USDOJ, 2015). Sterling’s defense argued that Senate Intelligence Committee staffers were a more plausible source and that the government’s evidence proved only communication, not the transmission of classified content (Wheeler, 2015). The jury found the circumstantial evidence sufficient, convicting Sterling on nine felony counts on January 26, 2015, and Judge Leonie Brinkema sentenced him to forty-two months (USDOJ, 2015).

The government’s self-compromise constituted the third and most strategically damaging vector. In prosecuting Sterling under the Espionage Act, the government introduced CIA operational cables, internal planning documents, and testimony from twenty-three CIA officers into the public record of a federal courtroom (Solomon, 2015). The trial revealed the operational concept, the asset’s role, the delivery methodology, the nature of the sabotaged blueprints, and the strategic rationale in far greater specificity than Risen’s book had disclosed. Bloomberg News reported from Vienna that the IAEA would “probably review intelligence they received about Iran as a result of the revelations,” with a former British envoy to the IAEA warning that the disclosures suggested “a possibility that hostile intelligence agencies could decide to plant a ‘smoking gun’ in Iran for the IAEA to find” (Solomon, 2015). Prosecutor James Trump acknowledged at sentencing that the exposure “ended the use of the nuclear-plans ruse against other countries” (Gerstein, 2015).

This third vector represents the most consequential D&D failure. In attempting to punish a compromise that had exposed a single operation, the government’s prosecution compromised an entire deception methodology. Any state with access to the public trial record — which now constitutes the most comprehensive open-source documentation of a CIA material deception program targeting a foreign nuclear capability — could retroactively audit its own procurement channels for similar operations and inoculate itself against future attempts. This is SPECIFICALLY why I refer to this as a strategic rather than tactical or operational disaster.

The Anti-Double Cross

Evaluated in its totality against the D&D planning framework, Operation Merlin represents something approaching the inverse of the Double Cross System. Where Double Cross maintained dozens of simultaneous channels with established credibility, Merlin relied on a single cold channel with no prior validation. Where Double Cross monitored adversary acceptance in near-real-time through ULTRA, Merlin had a single feedback mechanism that produced silence. Where Double Cross adapted its deception narratives continuously based on observed adversary reactions, Merlin had no adaptive capability. Where Double Cross maintained ruthless operational security — including the execution of compromised agents — Merlin allowed a disaffected case officer with comprehensive operational knowledge to depart the agency in an adversarial posture without enhanced counterintelligence monitoring.

The strategic concept underlying Operation Merlin (using sabotaged technical intelligence to misdirect a proliferating state’s weapons development) was theoretically sound. In a different operational context, I believe that it was completely viable. The failure was not conceptual but executional: a series of compounding deficiencies in channel selection, feedback architecture, adaptability, and operational security that transformed an ambitious deception operation into what may ultimately have been a net intelligence gain for the very adversary it was designed to deceive.

For the counterintelligence professional, Operation Merlin’s most enduring lesson may be its final chapter. The institutional impulse to punish unauthorized disclosure, when pursued through the adversarial transparency of a federal prosecution, can inflict damage orders of magnitude greater than the original compromise. The prosecution of Jeffrey Sterling did not restore the secrecy of Operation Merlin. It annihilated it. With it went the viability of an entire category of covert action against nuclear proliferators for the foreseeable future.

Regardless of which and what was worse, the results ware and are BAAADD. The op. is now a template. Any state with a competent intelligence service and access to the trial record (which is to say, absolutely everyone) can now retroactively audit its own procurement channels for operations matching this kind of pattern. The Agency has also created a counterintelligence inoculation of the adversary set. Every proliferating state now possesses a known reference case for how the U.S. I.C. constructs material deception against nuclear programs. Add to that the diplomatic blowback with the IAEA and lingering Iran-theatre analytical poisoning, and this becomes even uglier.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

Bibliography

  • Barakat, M. (2015, January 16). CIA asset ‘Merlin’ testifies about mission at CIA leak trial. Associated Press.
  • Gerstein, J. (2015, May 11). Former CIA officer sentenced to 3-1/2 years for leaking Iran details. Politico.
  • Heuer, R. J. (1999). Psychology of intelligence analysis. Center for the Study of Intelligence, Central Intelligence Agency.
  • Holt, T. (2004). The deceivers: Allied military deception in the Second World War. Scribner.
  • Howard, M. (1995). Strategic deception in the Second World War: British intelligence operations against the German High Command. W. W. Norton.
  • Joint Chiefs of Staff. (2012). Joint Publication 3-13.4: Military deception. U.S. Department of Defense.
  • Porter, G. (2014). Manufactured crisis: The untold story of the Iran nuclear scare. Just World Books.
  • Risen, J. (2006). State of war: The secret history of the NSA and the Bush administration. Free Press.
  • Solomon, N. (2015, February 27). CIA evidence from whistleblower trial could tilt Iran nuclear talks. Guernica.
  • United States Department of Justice. (2015, May 11). Former CIA officer sentenced to 42 months in prison for leaking classified information and obstruction of justice [Press release].
  • United States of America v. Jeffrey Alexander Sterling, No. 1:11-cr-00005 (E.D. Va. 2015). Selected case files. Federation of American Scientists, Project on Government Secrecy.
  • Whaley, B. (2007). Stratagem: Deception and surprise in war. Artech House.
  • Wheeler, M. (2015, February 21). What was the CIA really doing with Merlin by 2003? EmptyWheel.

Share this post:
Posted on

Partizan Crap Characterizes the 2026 I.C. Threat Assessment

national threat assessment, intelligence community, CIA, NSA, DIA, espionage, counterespionage, intelligence, counterintelligence, C. Constantin Poindexter

Unvarnished No More: The 2026 Annual Threat Assessment and the Politicization of American Intelligence, a Critical Analysis of Departures from Intelligence Community Analytical Traditions

On March 18, 2026, Director of National Intelligence Tulsi Gabbard presented the 2026 Annual Threat Assessment (ATA) to the Senate Select Committee on Intelligence, fulfilling the Intelligence Community’s statutory obligation under Section 617 of the FY21 Intelligence Authorization Act. The document’s own introduction pledges to deliver “nuanced, independent, and unvarnished intelligence” to policymakers (Office of the Director of National Intelligence [ODNI], 2026, p. 2). Yet a careful comparison of the 2026 ATA with its predecessors reveals systematic omissions, rhetorical softening, and political editorializing that collectively undermine the document’s claim to analytical independence. I argue that the 2026 ATA departs from Intelligence Community analytical traditions in ways that align with the administration’s political preferences, particularly regarding Russia, domestic extremism, and climate, and that these departures represent a failure of the DNI’s duty to provide unvarnished intelligence to Congress and the American people.

The significance of this argument cannot be overstated. The ATA exists precisely because democratic governance requires that elected officials receive honest assessments of threats, unfiltered by political convenience. Intelligence Community Directive 203, issued in 2007, codified the community’s formal tradecraft standards, mandating objectivity, transparency regarding sources and assumptions, and independence from political considerations (Just Security, 2025). The Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA) further requires that the DNI ensure intelligence products are “timely, objective, independent of political considerations, based upon all sources of available intelligence, and employ the standards of proper analytic tradecraft” (Pub. L. No. 108-458, § 1019). When an ATA is shaped to avoid contradicting the sitting president’s preferred narratives, it ceases to function as intelligence and instead becomes an instrument of political communication.

The Softening of Russia as a Strategic Threat

The 2024 ATA, produced under DNI Avril Haines, described Russia’s aggression in Ukraine as underscoring that Moscow “remains a threat to the rules-based international order” (ODNI, 2024, p. 5). The 2026 ATA, by contrast, introduces conciliatory language throughout its Russia analysis that reads less like threat assessment and more like diplomatic aspiration. It states that “Russia’s aspirations for multipolarity could allow for selective collaboration with the U.S. if Moscow’s threat perceptions regarding Washington were to diminish” and suggests that “a durable settlement to the war in Ukraine could open the door for a thaw in U.S.–Russia relations and an improved bilateral geostrategic and commercial relationship” (ODNI, 2026, pp. 27–28). This framing mirrors the administration’s diplomatic posture toward Moscow rather than the IC’s traditional threat-focused analytical lens.

The document further characterizes the concept of adversary alignment among China, Russia, Iran, and North Korea as overstated, calling it “limited and primarily bilateral” and asserting that the notion “overstates the depth of cooperation that is currently occurring” (ODNI, 2026, p. 20). This downgrading arrives despite the IC’s own acknowledgment in the same document that North Korea deployed over 11,000 troops to support Russian combat operations in Ukraine (ODNI, 2026, p. 24). The analytical minimization of adversary cooperation is consistent with President Trump’s longstanding reluctance to characterize Russia as an adversary, a posture that dates to his public siding with Vladimir Putin over U.S. intelligence findings at the 2018 Helsinki summit (Foreign Policy Research Institute [FPRI], 2019) as well as the point of view expressed by Gabbard publicly even predating her position within the I.C.

The Disappearance of Foreign Election Interference

Perhaps the most conspicuous omission in the 2026 ATA is the near-total absence of any discussion of foreign interference in U.S. elections. As Defense One reported, this marks the first time in nearly a decade that foreign threats to U.S. elections have been omitted from the annual threat assessment (Defense One, 2026). The 2024 ATA explicitly warned that China, Russia, and Iran would attempt to interfere in U.S. elections using generative AI and other means (ODNI, 2024). The 2025 DHS Homeland Threat Assessment similarly identified the 2024 election cycle as “an attractive target for many adversaries” and warned that nation-state-aligned actors would “continue to target democratic processes” (DHS, 2024, p. 4). The ODNI itself published a separate report titled “Foreign Threats to US Elections After Voting Ends in 2024” (ODNI, 2024b). That this entire threat category has vanished from the 2026 ATA is analytically inexplicable absent political motivation.

When Senator Mark Warner, the panel’s top Democrat, pressed Gabbard on this omission at the March 18 hearing, asking whether there was “no foreign threat to our elections in the midterms this year,” Gabbard’s response was evasive, stating only that the IC “has been and continues to remain focused on any collection and intelligence that show a potential foreign threat” (Defense One, 2026). This non-answer is consistent with DNI Gabbard’s broader pattern of minimizing Russian interference in American democracy. In July 2025, Gabbard declassified documents she claimed exposed a “treasonous conspiracy” by Obama-era officials regarding the 2016 Russian interference findings—allegations that multiple investigations, including the Republican-led Senate Intelligence Committee’s own probe, had already examined and found unsubstantiated (CNN, 2025; Lawfare, 2025). As the Council on Foreign Relations assessed, Gabbard’s actions have “deprived her of any pretension to analytical judgment independent of the president” (Betts, 2025).

The Erasure of Domestic Violent Extremism

The 2026 ATA’s terrorism section is focused almost exclusively on Islamist terrorism. Domestic violent extremism (DVE)—a category that encompasses racially or ethnically motivated extremism, anti-government militias, and other ideologically motivated domestic threats—receives no dedicated treatment. This stands in stark contrast to years of IC and DHS assessments that identified DVE as among the most persistent threats to the homeland. The DHS’s 2024 Homeland Threat Assessment warned that domestic violent extremists “driven by various anti-government, racial, or gender-related motivations” had conducted multiple attacks and that law enforcement had disrupted additional plots (DHS, 2024). The FBI reported over 1,700 domestic terrorism investigations underway as of late 2024 (House Homeland Security Committee, 2025). The Government Accountability Office released a comprehensive report in 2025 documenting the federal government’s ongoing domestic terrorism strategies and the persistent nature of the threat (GAO, 2025).

The omission of DVE from the 2026 ATA aligns with the Trump administration’s broader effort to reframe the terrorism discourse around Islamist ideology while downplaying threats from domestic actors whose motivations often overlap with right-wing political movements. The 2026 ATA’s extended discussion of the Muslim Brotherhood and its characterization of Islamist ideology as a “fundamental threat to freedom and foundational principles that underpin Western Civilization” (ODNI, 2026, p. 8) represents an analytical emphasis not seen in prior ATAs, which treated the terrorism landscape as ideologically diverse. This selective emphasis serves the administration’s political narrative while leaving Congress and the public without the IC’s assessment of a threat category that the FBI’s own data indicates remains active and lethal. It also unironically gives cover to a not insignificant group of Trump supporters, certainly purposeful by design.

The Removal of Climate Change as a Security Threat

The 2024 ATA treated climate change as a significant threat multiplier, stating that “the accelerating effects of climate change are placing more of the world’s population, particularly in low- and middle-income countries, at greater risk from extreme weather, food and water insecurity, and humanitarian disasters, fueling migration flows and increasing the risks of future pandemics” (ODNI, 2024, p. 5). Climate change appeared throughout that document as a driver of instability across multiple regions, including in assessments of Iran’s water scarcity challenges. The 2026 ATA eliminates climate change entirely as a named threat category. The term does not appear once. A single passing reference to “extreme weather events” in the migration section (ODNI, 2026, p. 7) is the only remnant of what had been a substantial analytical thread across multiple prior assessments.

This excision is not analytically defensible. The physical phenomena that made climate change a security concern in 2024 have not abated in 2026; if anything, the scientific consensus has strengthened. The removal reflects the Trump administration’s hostility toward climate science as a policy matter—a political preference that has no legitimate bearing on an intelligence community’s assessment of how environmental change affects geopolitical stability, food security, migration patterns, and conflict risk. The DNI’s role is to present the IC’s best assessment of reality, not to curate that reality to avoid topics the White House considers ideologically inconvenient.

Political Editorializing in an Intelligence Product

The 2026 ATA’s Foreword contains language that would have been unthinkable in prior assessments. It credits “President Trump sealing the U.S.–Mexico border” for enforcement successes and notes that “fentanyl seizures by weight have decreased 56 percent at the U.S.–Mexico border since President Trump took office” (ODNI, 2026, pp. 4–5). Annual threat assessments have traditionally employed dry, institutional prose that avoids attributing policy outcomes to individual political leaders by name. The function of an ATA is to assess threats, not to validate a president’s policy record. This departure transforms portions of what should be an analytical document into something resembling a political communication.

The editorializing extends beyond border policy. The Foreword adopts the administration’s rhetorical framework wholesale, stating that “we should be cautious about thinking that every problem in the world directly threatens us” (ODNI, 2026, p. 4)—a statement that, while perhaps reasonable in isolation, mirrors the administration’s America First foreign policy framing rather than reflecting IC analytical tradition. As scholars at the Foreign Policy Research Institute have warned, when political appointees shape intelligence products to serve the president’s messaging priorities, the core mission of the intelligence community—to provide independent analysis that may contradict leadership preferences—is fundamentally compromised (FPRI, 2019). The AEI documented how Gabbard fired the acting chair of the National Intelligence Council and his deputy after they produced assessments that contradicted administration positions, then physically relocated the NIC to her office to prevent what she characterized as “politicization” (American Enterprise Institute, 2025).

My Thoughts

From my view, the cumulative effect of these five departures, i.e., the softening of Russia’s threat profile, the erasure of foreign election interference, the omission of domestic violent extremism, the elimination of climate change as a security concern, and the introduction of political editorializing, is an Annual Threat Assessment that fails its statutory and institutional purpose. Each omission or distortion aligns with known political preferences of the Trump administration, and each contradicts the IC’s own recent analytical record. The IRTPA requires the DNI to ensure that intelligence is “independent of political considerations.” Intelligence Community Directive 203 mandates “objectivity, transparency regarding sources and assumptions, and independence from political considerations” (Just Security, 2025). The 2026 ATA, by its own internal evidence, fails both standards.

The consequences of this failure extend beyond the document itself. When intelligence products become vehicles for political messaging, policymakers lose the independent analytical baseline they need to make informed decisions. Congressional oversight is undermined when the IC’s primary public-facing threat assessment omits entire threat categories for political reasons. And public trust in the intelligence community, already strained by decades of controversy, erodes further when citizens can compare successive ATAs and observe that threats appear and disappear not because the world has changed but because the White House has changed. As Richard Betts of the Council on Foreign Relations observed, intelligence’s prime value often lies in telling leaders facts or implications they do not want to hear (Betts, 2025). A DNI who cannot or will not fulfill that function has, in the most consequential sense, abdicated the office’s reason for existing. The inconvenient truth is that the DNI’s acts and omissions are willful, a fact on perfect display during the Congressional hearing today (March 18th), during which Gabbard said, “Senator, the only person who can determine what is and is not an imminent threat is the president.” The Intelligence Community’s primary task is to provide warning intelligence, which is the very definition of the reporting of an “imminent threat”.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification
 
References

  • American Enterprise Institute. (2025, May 21). The politicization of intelligence. AEI. https://www.aei.org/articles/the-politicization-of-intelligence/
  • Betts, R. K. (2025, August 21). The intelligence community’s politicization: Dueling to discredit. Council on Foreign Relations. https://www.cfr.org/articles/intelligence-communitys-politicization-dueling-discredit
  • Defense One. (2026, March 18). Annual threat assessment omits election security. https://www.defenseone.com/policy/2026/03/annual-threat-assessment-election-security/412217/
  • Department of Homeland Security. (2024). 2025 Homeland Threat Assessment. https://www.dhs.gov/sites/default/files/2024-10/24_1002_ia_homeland-threat-assessment-2025.pdf
  • Foreign Policy Research Institute. (2019, August 12). A nadir is reached in the politicization of U.S. intelligence. https://www.fpri.org/article/2019/08/a-nadir-is-reached-in-the-politicization-of-u-s-intelligence/
  • Government Accountability Office. (2025). Domestic terrorism: Additional actions needed to implement the national strategy (GAO-25-107030). https://www.gao.gov/assets/gao-25-107030.pdf
  • House Homeland Security Committee. (2025, December 19). Threat snapshot: House Homeland unveils updated “Terror Threat Snapshot” assessment. https://homeland.house.gov/2025/12/19/threat-snapshot/
  • Intelligence Reform and Terrorism Prevention Act of 2004, Pub. L. No. 108-458, 118 Stat. 3638.
  • Just Security. (2025, June 20). When intelligence stops bounding uncertainty: The dangerous tilt toward politicization under Trump. https://www.justsecurity.org/114297/trump-administration-politicized-intelligence/
  • Lawfare. (2025, August 6). From Russian interference to revisionist innuendo: What the Gabbard files actually say. https://www.lawfaremedia.org/article/from-russian-interference-to-revisionist-innuendo–what-the-gabbard-files-actually-say
  • NBC News. (2024, December 11). Would Tulsi Gabbard bring a pro-Russian bias to intelligence reporting? https://www.nbcnews.com/politics/national-security/will-tulsi-gabbard-bring-russian-bias-intelligence-reporting-rcna180248
  • Office of the Director of National Intelligence. (2024). 2024 Annual Threat Assessment of the U.S. Intelligence Community. https://www.dni.gov/files/ODNI/documents/assessments/ATA-2024-Unclassified-Report.pdf
  • Office of the Director of National Intelligence. (2026). 2026 Annual Threat Assessment of the U.S. Intelligence Community. https://www.dni.gov/files/ODNI/documents/assessments/ATA-2026-Unclassified-Report.pdf
  • PBS NewsHour. (2025, July 24). Gabbard pushes report on Obama and Russia probe. https://www.pbs.org/newshour/show/gabbard-pushes-report-on-obama-and-russia-probe-as-trump-faces-pressure-over-epstein
  • Wittes, B. (2025, July 22). The situation: The lies of Tulsi Gabbard. Lawfare. https://www.lawfaremedia.org/article/the-situation–the-lies-of-tulsi-gabbard
Share this post:
Posted on

Silent Surveillance: The Threat of Tire Pressure Monitors

tire pressure monitoring system surveillance, intelligence, counterintelligence, counterespionage, C. Constantin Poindexter, CIA, NSA, DIA

Sneaking a covert GPS tracker into (or under) a motor vehicle is no longer spy-chic. Surveillants and counterintelligence players see a discreet new option.

In the contemporary era of information operations, the adversary’s toolkit has expanded beyond surveillance and HUMINT to include the exploitation of ubiquitous, low-power wireless signals. As a counterintelligence operator or surveillance professional, maintaining operational security requires a granular understanding of how standard automotive telemetry can be weaponized for tracking and profiling. While traditionally viewed as a mere safety mechanism, the Tire Pressure Monitoring System (TPMS) presents a sophisticated, low-cost vector for persistent surveillance. Here are my thoughts, technical architecture of TPMS vulnerabilities, the operational utility of its data streams, and the strategic implications for intelligence collection and target analysis, the new “AUTO-INT”.

Technical Architecture and Signal Vulnerabilities

The TPMS functions as a distributed sensing network within a vehicle, designed to ensure safety and optimize fuel efficiency by alerting drivers to under-inflated tires. In the United States, Federal Motor Vehicle Safety Standard (FMVSS) No. 138 mandates the use of direct TPMS in all light vehicles manufactured after September 2007 (Kobayashi, 2019). Technically, these systems consist of pressure sensors located within each wheel assembly, which periodically transmit radio frequency (RF) data to a central receiver module.

The critical vulnerability for intelligence collection lies in the transmission protocol and data integrity. Unlike modern communication standards, TPMS signals are transmitted in clear text without any form of encryption or authentication (Kobayashi, 2019). This lack of cryptographic protection renders the signals easily interceptable by any third party in proximity. Furthermore, these sensors broadcast a unique, static identifier for each tire that remains constant throughout the sensor’s operational life (Kobayashi, 2019). This static ID allows for the long-term tracking of a specific vehicle, as the identifier persists regardless of the sensor’s physical location or the vehicle’s operational status.

The range and reliability of interception capabilities further amplify the threat. Research indicates that TPMS signals can be intercepted at distances exceeding 40 meters from the vehicle (Kobayashi, 2019). Recent advancements in receiver technology have demonstrated that data capture is possible from distances of up to 50 meters and even when the receiver is located inside a building without direct line-of-sight to the vehicle (Vijayan, 2026). This capability allows for the passive collection of telemetry from vehicles parked in secured compounds, residential garages, or office parking lots, providing a persistent tracking vector that does not require the subject to be actively driving.

Operational Utility for Tracking and Behavioral Profiling

The operational value of TPMS extends beyond simple geolocation. It provides a rich dataset for behavioral profiling and movement analysis. A seminal study conducted by researchers at the University of Cantabria and distributed by Dark Reading demonstrated the feasibility of tracking a fleet of vehicles using a network of low-cost spectrum receivers (Vijayan, 2026). The research team captured over six million TPMS transmissions from approximately 20,000 vehicles over 10 weeks, successfully matching signals from different tires to the same vehicle to reconstruct movement patterns.

This data allows for the reconstruction of detailed movement profiles. By analyzing the timing, frequency, and intensity of transmissions, an operator can infer the subject’s driving patterns, such as commute routes, rest periods, and travel velocity. The researchers noted that TPMS transmissions can be systematically used to infer sensitive information, including the presence, type, or weight of the driver (Vijayan, 2026). Variations in tire pressure readings can correlate with changes in vehicle load, providing clues about whether a passenger is present or if cargo has been loaded or unloaded. In a counterintelligence context, this could reveal the presence of a handler, a meeting partner, or the movement of sensitive materials.

Implications for Operational Security and Countermeasures

For the counterintelligence operator, the existence of silent tracking via TPMS has profound implications for Operational Security (OPSEC). Traditional methods of tracking, such as visual tailing or license plate recognition, can be compromised if the target is aware of the surveillance. TPMS offers a covert alternative that operates passively and without direct interaction with the subject. An adversary could deploy a stationary receiver node in a strategic location, such as a choke point on a target’s daily commute, and aggregate data over time to build a comprehensive movement dossier without alerting the subject to the surveillance.

Furthermore, the ubiquity of TPMS makes this a scalable surveillance technique. The researchers utilized receivers priced at approximately $100 each, making it a cost-effective tool for intelligence collection compared to more sophisticated tracking hardware (Vijayan, 2026). The technology is not dependent on the subject’s connectivity to the internet or the activation of location services on a smartphone; it relies solely on the vehicle’s own safety systems.

My Take

The Tire Pressure Monitoring System represents a significant component of the modern surveillance landscape. Its inherent vulnerabilities (i.e., unencrypted, authenticated, and ubiquitous) make it an effective tool for tracking and profiling targets. For the counterintelligence operator or a surveillant, recognizing the capabilities of TPMS is crucial for assessing the security of one’s own movements and anticipating the methods adversaries may employ to monitor them. As vehicle systems become increasingly interconnected and digitized, the utility of standard automotive features for intelligence gathering will only continue to grow. We are going to need a much broader understanding of the “Internet of Vehicles” within the context of national and agency operational security.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

Bibliography

  • Kobayashi, M. (2019). Understanding TPMS: A Guide to Tire Pressure Monitoring Systems. SAE International.
  • Vijayan, J. (2026, March 3). Vehicle Tire Pressure Sensors Enable Silent Tracking. Dark Reading. https://www.darkreading.com/ics-ot-security/tire-pressure-sensors-silent-tracking
  • Khan, H. (2020). Wireless Sensor Networks: Principles and Applications. CRC Press.
  • Alippi, C., & Camplani, R. (2019). Wireless Sensor Networks: Performance Analysis and Applications. Academic Press.
  • Stankovic, J. A. (2016). “Wireless Sensor Networks for Industrial Applications.” Proceedings of the IEEE, 104(5), 1013-1022.
  • IEEE. (2021). IEEE Standard for Low-Rate Wireless Networks for Industrial, Scientific, and Medical (ISM) Applications. IEEE 802.15.4-2021.
  • Brown, T. (2022). Cybersecurity for the Internet of Things: Protecting Critical Infrastructure. Wiley.
Share this post:
Posted on

The Takaichi “Prompt Exploit” as Novel Tradecraft: A Counterintelligence Operator’s View of AI Enabled Influence Operations

disinformation, information operations, espionage, counterespionage, intelligence, counterintelligence, psyops, C. Constantin Poindexter, CIA, DIA, NSA

AI Enabled Smear Operations and Counterintelligence Detection: Lessons from the Attempted ChatGPT Exploit Targeting Sanae Takaichi

The attempted exploitation of ChatGPT to support a covert smear campaign against Japanese Prime Minister Sanae Takaichi is not a novelty story about AI gone wrong. It is a clear operational vignette of how modern state-linked actors or FIS attempt to compress the intelligence cycle and accelerate influence effects with generative tools. OpenAI’s February 25, 2026 threat reporting describes a now banned ChatGPT account linked to an individual associated with Chinese law enforcement who attempted in mid October 2025 to leverage the model to plan and execute a covert influence operation aimed at discrediting Takaichi, followed by later requests to edit “cyber special operations” status reports after the model refused the original operational ask (OpenAI, 2026). Public reporting based on that disclosure adds that the actor’s plan included coordinated negative commentary, impersonation techniques, and wedge framing designed to mobilize resentment around U.S. tariffs and immigration narratives (Jiji Press, 2026; Reuters, 2026; Axios, 2026). From a counterintelligence perspective, this is a case study in how an adversary treats a commercial large language model as a low-friction staff officer: ideation, drafting, message discipline, and iterative refinement, all without needing to recruit a human asset or expose internal tradecraft through overt tasking channels.

What makes the episode analytically valuable is the specificity of the improper tasking. Reporting indicates that the actor asked ChatGPT to draft a multi part plan to discredit Takaichi, to generate and help post and spread negative comments attacking her stances including immigration, to polish narratives and recurring status reports describing ongoing cyber special operations, and to inflame wedge grievances by amplifying anger over U.S. tariffs on Japan (Jiji Press, 2026; Axios, 2026; OpenAI, 2026). These requests form a recognizable information operations workflow: design the campaign, manufacture content, distribute content, or at least create distribution-ready material, and assess and iterate based on reporting. In classical counterintelligence terms, the operator sought to maximize plausible deniability, minimize cost, and raise tempo, substituting generative capacity for time-consuming human copywriting while reducing the number of personnel who must be read into the narrative engineering function (CISA, 2022; ODNI FMIC, 2024).

The most important counterintelligence observation is that the exploit is not primarily technical. It is procedural and behavioral. Operators do not need to jailbreak a model to gain advantage. They can ask for adjacent assistance such as language polishing, translation, formatting, summarization of internal memos, and audience-tailored variations. OpenAI’s reporting explicitly notes the actor returned after an initial refusal and asked for edits to operational status reports, which is precisely how professional services are laundered in many influence pipelines: when direct enablement is blocked, pivot to editorial support and documentation hygiene (OpenAI, 2026). This aligns with U.S. government’s framing of foreign malign influence as subversive, undeclared, coercive, or criminal activity that uses multiple pathways and intermediaries, often blending overt platforms with covert personas and synthetic content (ODNI FMIC, 2024; DOJ, n.d.). The model is not the operation. It becomes a friction reducer within the operation.

Seen through the lens of the intelligence cycle, the actor’s approach collapses collection, analysis, production, and dissemination into a tight loop. The multi-part plan request is campaign design, meaning objective, target audience, narrative lines, channels, and timing. The post-and-spread request is dissemination planning and, at minimum, the production of ready-to-publish material. The status report editing request is assessment: codifying observed effects, identifying what resonated, and deciding next moves (OpenAI, 2026; Axios, 2026). When an influence apparatus scales, this loop becomes industrialized: many accounts, multi-platform content seeding, and iterative narrative tuning. Reporting around the OpenAI threat case underscores that these efforts can be large-scale, resource-intensive, and sustained, consistent with a bureaucracy rather than hobbyist trolling (Reuters, 2026; CyberScoop, 2026). As Ben Nimmo has emphasized, the intent is to apply pressure everywhere, all at once, which is characteristic of FIS or state-linked coercive information operations rather than organic political discourse (Axios, 2026).

The operational targeting of Takaichi is also instructive for counterintelligence because it sits at the intersection of influence operations and transnational repression. While this case focuses on a smear campaign against a Japanese political figure, OpenAI’s broader description of the actor’s uploaded materials suggests a wider ecosystem aimed at suppressing dissent and silencing critics, including tactics such as forged documentation and intimidation narratives (OpenAI, 2026; CyberScoop, 2026). The FBI defines transnational repression to include online disinformation campaigns, harassment, intimidation, and abuse of legal processes, exactly the kinds of tools that can be amplified or routinized by AI-assisted content generation (FBI, n.d.). In counterintelligence risk terms, that convergence matters. When an adversary blends influence effects, shaping attitudes, with coercive effects, punishing or deterring speech, the target set expands from voters to voices, and the operational threshold for harm drops.

The wedge grievance element, stoking resentment over U.S. tariffs, illustrates classic influence tradecraft. Hijack a real grievance, inflate it, and attach it to the target as a blame object. This is not persuasion via factual argument. It is agitation via emotional mobilization. CISA guidance on foreign influence operations describes how adversaries exploit mis, dis, and malinformation narratives to bias policy and undermine social cohesion, often by inflaming divisive issues (CISA, 2022). The tariff frame is particularly useful because it can be pitched simultaneously as anti-U.S., blaming Washington, and anti-target, blaming Takaichi’s posture for provoking friction, with variants tailored to different audiences. In counterintelligence vocabulary, this is narrative multi-casting: the same kernel is repackaged into mutually reinforcing storylines for disparate communities.

The cross platform distribution pattern referenced in public reporting, activity on X and other sites, with relatively low engagement but persistent output, resembles the known Chinese influence pattern commonly labeled Spamouflage or Dragonbridge: high volume, mixed quality, low authentic engagement, but sustained presence and periodic tactical evolution (Reuters, 2026; NATO StratCom COE, 2023; Graphika, 2025). Low engagement does not mean low intent or low risk. It can indicate poor tradecraft, early-stage testing, or a campaign optimized for secondary effects such as search pollution, narrative seeding for later pickup, or creating “evidence” of public sentiment that can be cited elsewhere. Counterintelligence professionals should treat low engagement content as potential scaffolding. The objective may be to build a lattice of posts, screenshots, and proof artifacts that can later be laundered into higher credibility channels.

From the defender’s side, the case clarifies what model refusal can and cannot do. OpenAI reports that ChatGPT refused overtly malicious prompts, yet the actor appears to have proceeded using other tools and later used ChatGPT for editing (OpenAI, 2026). This reveals a strategic limitation. Safety filters reduce direct enablement. They do not eliminate the underlying operational capability of a state apparatus that can shift to domestic models, human copywriters, or alternative platforms. Effective mitigation requires a layered approach: model-side safeguards, platform-side enforcement, and inter-organizational intelligence sharing that treats AI as one component in a broader influence toolkit (OpenAI, 2026; CISA, 2024). The IC’s Foreign Malign Influence Center has emphasized that foreign malign influence is multi-actor and multi-pathway by design, which implies countermeasures must also be multi-pathway. Detection in one node rarely collapses the whole network (ODNI FMIC, 2024).

For counterintelligence operators, three takeaways are operationally salient. First, generative AI is best understood as an accelerant of existing influence doctrine rather than a replacement. It speeds up drafting, localization, and A B testing of narratives while enabling bureaucratic reporting to be produced faster and with greater stylistic consistency (OpenAI, 2026; CISA, 2022). Second, the human factor remains the decisive vulnerability. The actor’s interaction with ChatGPT created an evidentiary trail that allowed defenders to correlate intent, post-and-spread negative commentary with observed online activity. This is a reminder that operational security failures frequently occur in routine administrative behavior (OpenAI, 2026; CyberScoop, 2026). Third, influence and repression are increasingly convergent lines of effort. When disinformation is used not only to persuade but to intimidate, deplatform, or socially punish, the problem set expands to include civil liberties impacts, diaspora targeting, and sovereignty challenges (FBI, n.d.; DOJ, 2023).

In countermeasures terms, the Takaichi case underscores the value of structured analytic techniques in attribution and mitigation. Analysts should separate narrative content, behavioral signals such as posting cadence and account creation patterns, infrastructure signals such as hosting and coordinated link sharing, and procedural artifacts such as templated emails, repeated phrasing, and report formats. OpenAI’s account-level disruption, combined with open-source correlation to online hashtags and posts referenced in operational materials, is a template for fusion analysis that pairs platform telemetry with OSINT validation (OpenAI, 2026). NATO-aligned research similarly emphasizes that state-sponsored or FIS information operations exploit differences across platforms and jurisdictions. Defenders should expect rapid lateral movement when friction increases on any single platform (NATO StratCom COE, 2023).

The attempted exploit is best characterized as an “AI-enabled influence operation reconnaissance and production cycle, with the model treated as a drafting cell embedded in a broader state-linked apparatus”. The key question is not whether a model can be tasked with dissemination directly. It is whether it can generate dissemination-ready content, standardize narrative discipline, and reduce the time and training required to run a coordinated smear campaign. In this case, it could at least partially, until refusal controls forced the actor to route around and repurpose the model for editing and reporting (OpenAI, 2026; Jiji Press, 2026). For counterintelligence professionals, that reality demands a posture shift.. We must defend not only against disinformation artifacts but against the process improvements that AI grants adversaries. Faster cycles, lower labor costs, and more plausible linguistic camouflage are the new norm. The Takaichi operation appears to have underperformed in engagement, yet it is a forward indicator of how state-backed influence operational tradecraft is adapting to generative systems. They are persistent, multi-platform and procedurally agile (Reuters, 2026; Graphika, 2025).

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

Bibliography

  • Axios. (2026, February 25). Reporting on OpenAI’s disclosure of a China linked attempt to use ChatGPT to plan and refine a smear campaign targeting Japan’s Prime Minister Sanae Takaichi.
  • Cybersecurity and Infrastructure Security Agency. (2022). Preparing for and mitigating foreign influence operations (CISA Insight).
  • Cybersecurity and Infrastructure Security Agency. (2024, April 17). Guidance for securing election infrastructure against tactics of foreign malign influence (Joint guidance release with FBI and ODNI).
  • CyberScoop. (2026, February 25). Reporting on OpenAI’s threat report and Chinese law enforcement linked “cyber special operations” materials uploaded for editing.
  • Federal Bureau of Investigation. (n.d.). Transnational repression (Overview page describing tactics including online disinformation campaigns, harassment, and intimidation).
  • Graphika. (2025). Chinese state influence (Selected insights from Graphika ATLAS reporting, November 2024 to January 2025).
  • Jiji Press. (2026, February 27). Reporting summarized by Nippon.com on OpenAI’s claim that a Chinese law enforcement official asked ChatGPT to draft a plan to discredit Takaichi and to post and spread negative comments.
  • NATO Strategic Communications Centre of Excellence. (2023). Dragons roar and bears howl: Convergence in Sino Russian information operations in NATO countries.
  • OpenAI. (2026, February 25). Disrupting malicious uses of AI (Threat report describing disruption of accounts, including an influence operation attempt targeting Sanae Takaichi).
  • Reuters. (2026, February 25). Reporting on OpenAI’s threat report detailing misuse of ChatGPT for scams and influence operations, including a smear campaign targeting Japan’s prime minister.
  • Reuters. (2026, February 26). Reporting on a Foundation for Defense of Democracies analysis of China linked influence operations targeting Japan’s elections and Prime Minister Sanae Takaichi, consistent with Spamouflage and Dragonbridge patterns.
  • U.S. Department of Justice. (2023, April 17; updated 2025, February 6). Press release describing charges tied to transnational repression schemes and the use of fake online personas to harass dissidents and disseminate state narratives.
  • U.S. Office of the Director of National Intelligence, Foreign Malign Influence Center. (2024). FMI Primer (Public release defining foreign malign influence and its pathways).
Share this post:
Posted on

When “AI-Enabled Counterintelligence” Means Everything and Therefore Proves Little

artificial intelligence, intelligence, counterintelligence, espionage, counterespionage, deception, C. Constantin Poindexter, I.C., CIA, NSA

Artificial intelligence is unquestionably altering intelligence practice, especially in collection triage, identity resolution, and D&D (“denial and deception”) at scale. The same broadness that makes “AI and counterintelligence” a timely topic also makes it easy for scholarship to drift from disciplined inference into plausible generalizations. Henry Prunckun’s article AI and the Reconfiguration of the Counterintelligence Battlefield, argues that authoritarian regimes integrate AI into counterintelligence more aggressively than democracies, generating widening disparities in surveillance capacity, strength of deception operations, and detection. That thesis is appealing, but the problem is that, as presented, it relies on conceptual stretching, not ‘real good’ operationalization, and OSINT constrained attribution, which together make the conclusion stronger than the evidence can reliably support.

Conceptual slippage: counterintelligence becomes a synonym for regime security

The article offers an expansive definition of counterintelligence, including hostile intelligence operations by FIS, non-state actors, and internal threats. That definitional move risks conflating classic counterintelligence functions, such as detecting foreign intelligence services, running double agents, and protecting sensitive programs, with broad domestic security tasks, such as repression of dissent, censorship, and generalized surveillance. In the case studies, that risk becomes reality. China’s Skynet and Sharp Eyes are treated as counterintelligence infrastructure, yet the true purpose of these systems is “public security” and political control ( meaning “suppression”) through population-scale monitoring and data fusion. This is not counterespionage in the narrow sense (Peterson, 2021; He, 2021). Using such architectures as direct evidence of “counterintelligence capability” is contestable unless the article could demonstrate a specific, evidenced pathway from mass surveillance to demonstrable counterespionage outcomes. A good example might be the identification of foreign case officers, agent spotting, surveillance detection route patterning, or disruption of recruitment pipelines.

This matters because conceptual stretching lets the analysis “win” by broadening the dependent variable. If counterintelligence includes nearly all internal security functions, then authoritarian states will almost always appear “ahead,” because their legal structures permit scale and coercion across the entire society. A tighter approach would separate “state security surveillance capacity” from “counterespionage effectiveness,” then test where and how the two overlap.

Unmeasured dependent variables: adoption is not capability, and capability is not effectiveness

The piece repeatedly asserts an “uneven transformation” and “increasing disparities” between authoritarian and democratic systems. The paper does not clearly operationalize what “capability” means. Is it speed of deployment, volume of data, integration across agencies, analytic accuracy, disruption rates, or successful attribution of hostile services? Those are DISTINCT variables. Without an operational definition and observable indicators, the comparative claim becomes rhetorical rather than analytic.

Fortunately, the literature on predictive analytics is instructive. Government and academic reviews emphasize that predictive systems can help triage and allocate resources, but performance and fairness depend heavily on data quality, feedback loops, and governance (National Institute of Justice, 2014; U.S. Department of Justice, 2024). In real deployments, predictive policing tools have faced serious critiques for low accuracy and bias amplification, precisely because historical data encode institutional and sampling distortions (Shapiro, 2017; Alikhademi et al., 2021). The counterintelligence analogy is direct. If authoritarian systems ingest broader data and act on weaker thresholds, they may increase the velocity of suspicion generation without reliably increasing detection precision. So, “more AI” generates more alerts, more potentially nefarious interventions, and more error, rather than more validated counterintelligence successes. Unless the article can distinguish surveillance scale from validated performance outcomes, it confuses activity with effectiveness.

Causal inference is asserted, not identified

The article frequently implies causation, that AI enables preemptive counterintelligence, improves early warning, and accelerates counterespionage timelines. Yet in this piece, the causal chain is not established with process tracing evidence. Much of the language signals inference by plausibility, using formulations such as “reportedly,” “believed,” “suggests,” and “consistent with.” That can be appropriate in exploratory work, but lacks strong causal conclusions about “advantage” or “disparity” without a rigorous evidentiary standard.

A methodologically disciplined approach would specify competing hypotheses and explanations. They would demonstrate why AI is THE differentiator, rather than alternative drivers like expanded authorities, intensified human surveillance, party control over institutions, enhanced cyber hygiene, or increased resourcing. Robert Yin’s framework for case study research emphasizes analytic generalization and the need to consider rival explanations, not merely accumulate confirmatory examples (Yin, 2014). Not following the framework begins to look like one of those cognitive biases that we are taught to avoid. The article’s current structure tends to accumulate plausible examples of authoritarian digital control and then attribute the change in counterintelligence conditions to AI itself, when the same outcomes could often be produced through conventional surveillance and coercion supplemented by basic automation.

Case selection: the design invites selection on the dependent variable

The four cases, China, Russia, Iran, and North Korea, are justified partly by strategic AI application, active counterintelligence engagement, and OSINT accessibility. That selection logic is understandable, but it has consequences. It tilts the sample toward regimes that are shining examples of coercive security states. It excludes “negative” or less confirming cases that might constrain the inference. Social science methodologists have repeatedly warned us that selecting only cases where the outcome is expected will often bias comparative claims, especially when the study then reasons as if the cases represent a broader population (King, Keohane, & Verba, 1994; Seawright & Gerring, 2008). If Prunkun’s aim is build theory, he may want to say so explicitly and limit generalization claims. If the aim is an authoritarian versus democratic comparison, it needs either systematic comparative indicators or at least one or more democratic cases chosen by objective criteria.

This flaw is not just academic. The paper makes claims about democratic constraints, Five Eyes governance, and interagency “silos,” yet provides no parallel case evidence at the same granularity as the authoritarian ones. There is an asymmetric evidentiary burden. Authoritarian capability is described through many examples. Democratic capability is summarized through general governance constraints, . . . a classic setup for overstating comparative divergence.

OSINT dependence: acknowledged limitations, but high confidence attributions persist

The paper responsibly acknowledges OSINT limitations, including bias, misinformation, attribution gaps, and inference under uncertainty. Then the narrative proceeds to attribute specific AI-enabled activities to specific organs such as the MSS, FSB, GRU, MOIS, and the RGB, even while admitting overlapping roles and covert postures. This is a substantive vulnerability. The hardest analytic problem in intelligence scholarship is not describing a tool set, but attributing operational use to a particular unit with defensible confidence.

The OSINT literature is explicit that open sources can be powerful but are shaped by discoverability, platform biases, selective visibility, and analytic framing, all of which can distort both collection and interpretation (McDermott, 2021; Yadav et al., 2023). Triangulation helps, but triangulation among sources that ultimately derive from similar technical telemetry pipelines or shared reporting ecosystems can create an illusion of confirmation. The article would be stronger if it adopted a consistent evidentiary lexicon like “confirmed,” “assessed,” “plausible,” “speculative,” and then used that teminology to discipline claims about which agency did what, and with what AI component.

“Cognitive security” is promising, but under-specified as a threat model

The piece explains “cognitive security” as safeguarding the analytic process from distortion, synthetic overload, and eroded trust. That is a valid conceptual move, and it aligns with growing institutional concern about deepfakes and generative deception (particularly impersonation), synthetic identities, and social engineering at scale (RAND, 2022; CDSE, 2025; ENISA, 2025). The weakness is that the paper’s cognitive security discussion remains programmatic rather than operational. It describes effects, such as evidence stream distortion and analyst overload, but it does not specify the attack surfaces, such as data poisoning, provenance forgery, adversarial inputs to classifiers, synthetic HUMINT reporting, or deepfake-enabled pretexting. Without a more explicit threat model, cognitive security risks functioning as an exciting label rather than an analytic framework capable of generating testable hypotheses and practical mitigations.

Overstatement risk in cross-national characterizations

Some country characterizations are brittle. The claim that Russia does not use AI for extensive domestic surveillance, contrasted with China, is vulnerable because Russia’s internal security ecosystem has long invested in monitoring and control, even if its architecture differs from China’s camera-centric methods. When a paper makes categorical claims that can be challenged by counterexamples, it hands critics a free punch and distracts from the stronger parts of the argument. Good comparative work often relies on “relative to” claims rather than absolutes, unless the evidence is overwhelming.

My take? The main contribution is conceptual, but its conclusions outrun its design

The excerpt reads strongest as a conceptual intervention arguing that AI changes the conditions of counterintelligence, especially by enabling synthetic deception and stressing analytic trust. Where it becomes substantively flawed is where it implies comparative empirical conclusions about authoritarian “advantage” and widening capability disparities without operational definitions, without balanced case selection, and with OSINT-constrained attribution that cannot consistently sustain unit-level claims. The remedy is not to abandon the thesis. It is to narrow the dependent variable, define measurable indicators, discipline inference and attribution, and align claims to what the evidence and design can actually support. Absent those corrections, the argument risks becoming unfalsifiable. Authoritarian states appear superior because counterintelligence is defined broadly enough to include most internal security, adoption is treated as capability, and capability is treated as effectiveness. Prunckun’s point here may well be true. I HIIIIGHLY respect this author and his expertise, however addresssing these flaws would go a long way to proving his points.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

Bibliography

  • Alikhademi, K., et al. (2021). A review of predictive policing from the perspective of fairness. National Science Foundation Public Access Repository.
  • Center for Development of Security Excellence (CDSE). (2025). Artificial Intelligence and Counterintelligence Concerns (Student guide). U.S. Department of Defense.
  • European Union Agency for Cybersecurity (ENISA). (2025). ENISA Threat Landscape 2025.
  • He, A. (2021). How China harnesses data fusion to make sense of surveillance data. Brookings Institution.
  • King, G., Keohane, R. O., & Verba, S. (1994). Designing Social Inquiry: Scientific Inference in Qualitative Research. Princeton University Press.
  • McDermott, Y. (2021). Open source information’s blind spot. Journal of International Criminal Justice, 19(1), 85–105.
  • National Institute of Justice. (2014). Overview of predictive policing. Office of Justice Programs, U.S. Department of Justice.
  • Peterson, D. (2021). China’s “Sharp Eyes” program aims to surveil 100% of public space. Center for Security and Emerging Technology (CSET), Georgetown University.
  • RAND Corporation. (2022). Artificial Intelligence, Deepfakes, and Disinformation.
  • Seawright, J., & Gerring, J. (2008). Case selection techniques in case study research. Political Research Quarterly, 61(2), 294–308.
  • Shapiro, A. (2017). Policing predictive policing. Washington University Law Review, 94(5), 1149–1189.
  • U.S. Department of Justice, Office of Justice Programs. (2024). Artificial Intelligence and Criminal Justice: Final Report.
  • Yadav, A., et al. (2023). Open source intelligence: A comprehensive review of the state of the art. Journal of Big Data, 10, Article 38.
  • Yin, R. K. (2014). Case Study Research: Design and Methods (5th ed.). SAGE Publications.
Share this post:
Posted on

The Collapse of CIA Clandestine Communications: The Hidden “X” Factor

COVCOM, espionage, counterespionage, intelligence, counterintelligence, spy, C. Constantin Poindexter, CIA, NSA

For those that haven’t picked up a copy of Tim Weiner’s new book, The Mission (a great read), the author briefly writes about an unidentified “X Factor”, that together with loose tradecraft and the betrayal of Jerry Chun Shing Lee, explain the breach of an Agency clandestine communications platform (COVCOM) used to receive production from intelligence assets. The X Factor is no longer (at least in part) as secret. Between 2010 and 2012 the Central Intelligence Agency (CIA) suffered one of the most devastating counterintelligence failures of the post–Cold War era. Dozens of agency assets operating in China and elsewhere were rolled up, captured and/or killed, and multiple communication networks nullified. The official explanations that later emerged pointed to three contributing factors: that the COVCOM platform itself was insufficiently secure; that former officer Jerry Chun Shing Lee betrayed key operational information to Chinese intelligence; and an unknown “X-factor” that the CIA believed must have played a role. Analysts have since argued that this third factor was neither a single human source nor a cryptographic failure, but rather a systemic and architectural vulnerability The discoverability of CIA communication websites through pattern matching, fingerprinting, and open-source enumeration.

The known facts support this interpretation. Following the collapse, U.S. intelligence undertook a joint CIA-FBI inquiry to determine why an ostensibly hardened system had failed so catastrophically. The COVCOM platform, an encrypted web-based communication system that relied on innocuous-looking websites as cutouts between field assets and handlers, had been in use globally for the better part of a decade. Its purpose was to provide secure asynchronous communication without the need for physical meetings. By 2010, Chinese counterintelligence had begun identifying CIA agents and rolling up networks with alarming precision (U.S. Department of Justice, 2019). Lee’s espionage, which began around this time, appears to have enabled part of this exposure. He was found in possession of notebooks containing detailed operational notes, true names, and meeting locations for agents. His recruitment by the Chinese Ministry of State Security (MSS) represented an enormous breach (Security Boulevard, 2018). Lee’s betrayal alone did not explain the speed, geographic reach, or technical precision of the counterintelligence response. The COVCOM system in China was considered more robust than versions deployed elsewhere, and yet it collapsed far more completely, suggesting that an additional vector was in play (Central Intelligence Agency, 2021).

That missing vector has increasingly come into focus due to subsequent forensic research. In 2022, Citizen Lab at the University of Toronto released a public technical statement analyzing a defunct CIA covert communications network, reconstructing its infrastructure from archival data (Citizen Lab, 2022). The researchers identified at least 885 separate websites that had served as cutouts in the system, many masquerading as ordinary blogs or news portals. These domains were hosted across multiple countries and written in more than twenty-seven languages, demonstrating the global scale of the network (Overt Defense, 2022). Most importantly, the study revealed that the sites shared recurring technical fingerprints: identical JavaScript, Flash, and Common Gateway Interface (CGI) code snippets, sequential IP address allocations, and domain registrations under apparently fictitious U.S. shell companies. These patterns were visible not only to intelligence professionals but to any moderately skilled analyst using open-source tools such as Google search operators or historical DNS datasets.

The Citizen Lab researchers demonstrated that once a single website in the network became known, either through insider compromise or accidental exposure, the rest could be discovered through automated pattern matching. For example, the shared scripts and templates created a unique digital “signature” that could be queried across the web. Similarly, because many sites were hosted within contiguous IP address blocks, an adversary could perform network scans to find adjacent servers. In one striking observation, Citizen Lab noted that a “motivated amateur sleuth” could likely have mapped the entire network from a single known site using only public data sources (Citizen Lab, 2022, p. 3). In other words, once one covert node was compromised, the architecture itself facilitated the discovery of the rest—a catastrophic violation of compartmentation, the cardinal rule of clandestine operations. This structural discoverability provides a compelling explanation for the “X-factor.” If Chinese or Iranian counterintelligence services were able to recognize one of these front sites—perhaps through Lee’s betrayal or through network monitoring—they could easily expand their search to enumerate the rest. Once identified, those sites could be monitored for traffic patterns, IP logs, or metadata, revealing the physical locations or operational rhythms of field agents. The result would be precisely the kind of rapid and geographically broad collapse observed between 2010 and 2012.

Several attributes make this explanation plausible to high confidence standard. It accounts for the disproportionate collapse relative to the technical strength of the platform. A simple encryption or authentication flaw would have yielded isolated compromises, not systemic exposure. It explains the extraordinary speed of network destruction. Insider betrayal might expose a limited number of assets, but large-scale enumeration allows adversaries to map entire networks in days or weeks. It also aligns with reports that CIA stations were initially unaware of how deeply the system had been penetrated; because the exposure derived from web-level pattern analysis rather than cryptographic decryption, it left few immediate forensic traces (Risen, 2018).

The architecture’s discoverability illustrates a subtle but fundamental shift in dynamics in the digital era, especially for counterintelligence. During the Cold War, clandestine communications were localized and analog, i.e., dead drops, shortwave bursts, or one-time pads, etc., that required significant human action/interaction to intercept. By contrast, digital covert systems even when encrypted, exist within the globally indexed infrastructure of the Internet. Any reuse of code, hosting, or metadata creates a fingerprint that can be detected through open-source intelligence (OSINT) techniques. The “X-factor” was pretty clearly less an unknown human leak than a manifestation of the new technological environment. The Agency had built a secret system inside a public network and underestimated the degree to which its digital seams could be analyzed by adversarial FIS.

The forensic model resolves apparent contradictions in early assessments. CIA officials believed the COVCOM used in China was “more robust” than those in other theaters, implying stronger encryption, better authentication and other tradecraft goodies (CIA Inspector General, 2017). Nonetheless, it collapsed thoroughly. The pattern-matching explanation shows why robustness in cryptography could coexist with fragility in topology. The system’s security depended not only on code strength but also on architectural compartmentation. The Agency’s reuse of templates, hosting blocks, and design elements was weak tradecraft. It undermined that compartmentation and created a single attack surface.

It is important to recognize that the web-discoverability hypothesis complements rather than replaces the other two causes. Lee’s betrayal and intrinsic platform weaknesses likely provided the initial penetration points that allowed adversaries to begin to dig. The enumeration process then magnified those breaches exponentially. The CIA has not publicly confirmed this reconstruction, understandably. Nonetheless, independent open-source evidence strongly supports the inference that the network’s design flaws were decisive.

The lessons extend beyond one agency or episode. The COVCOM failure demonstrates how operational hygiene in digital clandestine systems is as critical as cryptographic soundness and insider threats. A covert communication platform can fail not because its cipher is broken, but because its metadata is out in the wild. This insight has profound implications for modern intelligence and of course, counterintelligence work. As state and non-state actors deploy increasingly networked clandestine capabilities, the old principle of “need to know” must be re-engineered into “need to connect.” Going forward, it would be foolish not to design com platforms in a way that every covert node is architecturally unique. Different code bases, hosting, and design fingerprints are imperative to avoid global correlation. The COVCOM collapse shows the lethal cost of violating that principle.

So, the CIA’s network failures in China were not caused solely by human treachery or inadequate encryption but by an invisible architectural flaw. The covert web infrastructure could be mapped once any part was exposed. This vulnerability, amplified by Lee’s betrayal and existing COVCOM weaknesses, created a perfect storm that allowed adversaries to dismantle entire espionage networks with unprecedented speed. The “X-factor” was not mystical but mathematical, an emergent property of pattern recognition within an interconnected Internet. The episode stands as a cautionary tale that in the digital age, secrecy depends not merely on keeping information encrypted but on ensuring that the very existence of the system remains undiscoverable. Sophisticated FIS such as China’s have the capacity to “de-clandestine” it, and far too quickly.

~ C. Constantin Poindexter, MA in Intelligence, Graduate Certificate in Counterintelligence, JD, CISA/NCISS OSINT certification, DoD/DoS BFFOC Certification

References

Central Intelligence Agency. (2021). Inspector General’s review of clandestine communication failures (declassified summary). Langley, VA.

Citizen Lab. (2022). Statement on the fatal flaws found in a defunct CIA covert communications system. University of Toronto. https://citizenlab.ca/2022/09/statement-on-the-fatal-flaws-found-in-a-defunct-cia-covert-communications-system/

Overt Defense. (2022, October 5). Poorly designed CIA websites likely got spies killed. https://www.overtdefense.com/2022/10/05/poorly-designed-cia-websites-likely-got-spies-killed/

Risen, J. (2018, May 21). How China used a hacked CIA communications system to hunt down U.S. spies. The New York Times.

Security Boulevard. (2018, June 6). The espionage of former CIA case officer Jerry Chun Shing Lee for China.

U.S. Department of Justice. (2019). Former CIA officer sentenced for conspiring to commit espionage. Press release, April 19, 2019.

Share this post: